Depend on a version of community-modules, not a branch

projectsend/community-modules is published and tagged now, so the
dependency can name a version. It could not before: with nothing to point
at, composer.json carried "*" against a vcs entry, which meant every
install resolved the default branch and got whatever had been pushed to it.
`composer validate` has been saying so on every run — "unbound version
constraints (*) should be avoided" — and it is right, because a dependency
that tracks a branch cannot be reasoned about and cannot be rolled back.

So: "^1.0", and the vcs entry goes. It has to go rather than merely stop
being needed, for the same reason the migration tool's did — a repository
declared in composer.json is canonical and outranks packagist.org, so
leaving it would keep serving dev-main off the default branch and shadow
every release ever tagged. Silently, which is the part that matters.

The lock moves with it: dev-main 311883a becomes v1.0.0, sourced from
Packagist rather than a git clone of a moving branch. Same code — the tag
was cut from that commit — but now it is a code somebody can name.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

composer.json

@@ -8,12 +8,6 @@
         "framework"
     ],
     "license": "GPL-2.0-or-later",
-    "repositories": [
-        {
-            "type": "vcs",
-            "url": "https://github.com/projectsend/community-modules"
-        }
-    ],
     "require": {
         "php": "^8.4",
         "bacon/bacon-qr-code": "^3.1",
@@ -27,7 +21,7 @@
         "laravel/tinker": "^2.10.1",
         "league/flysystem-aws-s3-v3": "^3.29",
         "pragmarx/google2fa": "^9.0",
-        "projectsend/community-modules": "*",
+        "projectsend/community-modules": "^1.0",
         "stevebauman/purify": "^6.3",
         "tightenco/ziggy": "^2.4"
     },

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "cfcaf0c1e3208e2f96b6879bb0eaf3a7",
+    "content-hash": "8aeea042b113838ea5a2a2dcfb0965c5",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -4052,7 +4052,7 @@
         },
         {
             "name": "projectsend/community-modules",
-            "version": "dev-main",
+            "version": "v1.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/projectsend/community-modules.git",
@@ -4074,7 +4074,6 @@
                 "orchestra/testbench": "^10.0",
                 "pestphp/pest": "^3.8"
             },
-            "default-branch": true,
             "type": "library",
             "extra": {
                 "laravel": {
@@ -4088,18 +4087,14 @@
                     "ProjectSend\\CommunityModules\\": "src/"
                 }
             },
-            "autoload-dev": {
-                "psr-4": {
-                    "ProjectSend\\CommunityModules\\Tests\\": "tests/"
-                }
-            },
+            "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "GPL-2.0-or-later"
             ],
             "description": "Community-exclusive feature modules for ProjectSend — free software, never part of the hosted Cloud edition.",
             "support": {
-                "source": "https://github.com/projectsend/community-modules/tree/main",
-                "issues": "https://github.com/projectsend/community-modules/issues"
+                "issues": "https://github.com/projectsend/community-modules/issues",
+                "source": "https://github.com/projectsend/community-modules/tree/v1.0.0"
             },
             "time": "2026-08-16T18:45:51+00:00"
         },