From 139c8ebf4c9dff3bb74ed0c916c3cb4ad1038820 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Bajsarowicz?= <lukasz@lbajsarowicz.me>
Date: Wed, 29 Apr 2026 22:36:06 +0200
Subject: [PATCH] chore: add magento-deploy-ignore for setup/ + autoload
 fallback

Issue #40695

- Add `magento-deploy-ignore` extra so deployment artifacts can strip
  /setup and /update directories (web Setup Wizard is deprecated;
  shipping it to production web nodes is unnecessary attack surface).
- Add fallback autoload path to vendor/magento/magento2-base/setup/
  for the Magento\Setup\* namespace so CLI tooling that still needs
  setup classes keeps resolving when the repository copy is stripped
  by the deploy-ignore step.

Local development resolution is unchanged: setup/src/Magento/Setup/
remains the primary path. Verified `composer dump-autoload -o`
generates 26959 classes and Magento\Setup\Console\Command\* loads.
---
 composer.json | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index cc5165e913d19..7e1d7a40f0034 100644
--- a/composer.json
+++ b/composer.json
@@ -361,6 +361,12 @@
         "gene/bluefoot": "*"
     },
     "extra": {
+        "magento-deploy-ignore": {
+            "*": [
+                "/setup",
+                "/update"
+            ]
+        },
         "component_paths": {
             "trentrichardson/jquery-timepicker-addon": "lib/web/jquery/jquery-ui-timepicker-addon.js",
             "components/jquery": [
@@ -378,7 +384,10 @@
     "autoload": {
         "psr-4": {
             "Magento\\Framework\\": "lib/internal/Magento/Framework/",
-            "Magento\\Setup\\": "setup/src/Magento/Setup/",
+            "Magento\\Setup\\": [
+                "setup/src/Magento/Setup/",
+                "vendor/magento/magento2-base/setup/src/Magento/Setup/"
+            ],
             "Magento\\": "app/code/Magento/"
         },
         "psr-0": {