From db27f24c2bc47b8df305cb1d9c8f2d54ce01f9a0 Mon Sep 17 00:00:00 2001
From: Sebastian Mendel <info@sebastianmendel.de>
Date: Wed, 19 Aug 2026 20:33:47 +0200
Subject: [PATCH] docs: git is no longer an alternative to unzip since Composer
 2.10

Composer 2.10 removed the automatic fallback from a failed dist extraction to a
source checkout (composer/composer#12885), and PIE has shipped Composer 2.10
since 1.4.8. An image that only has git installed now fails with "The zip
extension and unzip/7z commands are both missing" instead of cloning the
package.

git is still required for repositories Composer reads over git, so the note
keeps it rather than dropping it.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Assisted-by: claude-code:claude-opus-5
Agent-Session: https://claude.ai/code/session_0129QU37uCnSL1ZkmD8bdqxQ
Agent-Host: 0493f0
---
 docs/ja/usage.md |  5 ++++-
 docs/usage.md    | 15 ++++++++++++---
 docs/zh/usage.md |  5 ++++-
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/docs/ja/usage.md b/docs/ja/usage.md
index 029f114e..4ccb4f43 100644
--- a/docs/ja/usage.md
+++ b/docs/ja/usage.md
@@ -48,7 +48,10 @@ COPY --from=ghcr.io/php/pie:bin /pie /usr/bin/pie
 
 #### Dockerfile での PIE の動作例
 
-これは Docker イメージ内で PIE を使用して拡張機能をインストールする方法の例です。Composer と同様に、`unzip`、[Zip](https://www.php.net/manual/ja/book.zip.php) 拡張機能、または `git` のようなものが必要です。
+これは Docker イメージ内で PIE を使用して拡張機能をインストールする方法の例です。Composer と同様に、ダウンロードしたパッケージを展開するために `unzip` または [Zip](https://www.php.net/manual/ja/book.zip.php) 拡張機能が必要です。
+
+> [!NOTE]
+> 以前は `git` がインストールされていれば代替となりました。展開に失敗した場合、Composer がソースからのチェックアウトにフォールバックしていたためです。Composer 2.10 はセキュリティ上の理由でこのフォールバックを削除し（[composer/composer#12885](https://github.com/composer/composer/pull/12885)）、PIE は 1.4.8 以降 Composer 2.10 を使用するため、`git` だけでは不十分です。`pie repository:add vcs ...` で追加したリポジトリなど、Composer が git 経由で読み取るリポジトリには引き続き必要です。
 
 ```Dockerfile
 FROM php:8.4-cli
diff --git a/docs/usage.md b/docs/usage.md
index b1ac5624..360ae5cf 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -63,9 +63,18 @@ Instead of `bin` tag (which represents latest binary-only image) you can also us
 #### Example of PIE working in a Dockerfile
 
 This is an example of how PIE could be used to install an extension inside a
-Docker image. Note that, like Composer, you need something like `unzip`, the
-[Zip](https://www.php.net/manual/en/book.zip.php) extension, or `git` to be
-installed.
+Docker image. Note that, like Composer, you need `unzip` or the
+[Zip](https://www.php.net/manual/en/book.zip.php) extension to be installed, so
+that the downloaded package can be extracted.
+
+> [!NOTE]
+> Having `git` installed used to be an alternative, because Composer fell back
+> to a source checkout when extraction failed. Composer 2.10 removed that
+> fallback for security reasons
+> ([composer/composer#12885](https://github.com/composer/composer/pull/12885)),
+> and PIE uses Composer 2.10 as of 1.4.8, so `git` on its own is no longer
+> enough. It is still needed for repositories that Composer reads over git,
+> such as those added with `pie repository:add vcs ...`.
 
 ```Dockerfile
 FROM php:8.4-cli
diff --git a/docs/zh/usage.md b/docs/zh/usage.md
index a8410daf..2295fbb9 100644
--- a/docs/zh/usage.md
+++ b/docs/zh/usage.md
@@ -48,7 +48,10 @@ COPY --from=ghcr.io/php/pie:bin /pie /usr/bin/pie
 
 #### 在 Dockerfile 中使用 PIE 的示例
 
-这是如何在 Docker 镜像中使用 PIE 安装扩展的示例。注意，与 Composer 类似，您需要安装 `unzip`、[Zip](https://www.php.net/manual/zh/book.zip.php) 扩展或 `git`。
+这是如何在 Docker 镜像中使用 PIE 安装扩展的示例。注意，与 Composer 类似，您需要安装 `unzip` 或 [Zip](https://www.php.net/manual/zh/book.zip.php) 扩展，以便解压下载的软件包。
+
+> [!NOTE]
+> 以前只安装 `git` 也可以，因为解压失败时 Composer 会回退到从源代码检出。Composer 2.10 出于安全原因移除了该回退（[composer/composer#12885](https://github.com/composer/composer/pull/12885)），而 PIE 从 1.4.8 起使用 Composer 2.10，因此仅安装 `git` 已不再足够。对于 Composer 需要通过 git 读取的仓库（例如通过 `pie repository:add vcs ...` 添加的仓库），仍然需要 `git`。
 
 ```Dockerfile
 FROM php:8.4-cli