Plugin Dependencies

Method declares the plugins it needs in a wp-dependencies.json file in the theme root and hands the list to WP Dependency Installer (installed through Composer into vendor/). A required plugin installs and activates itself on the next admin page load; an optional one produces a dismissible notice with an install link. A child theme adds its own plugins by dropping a wp-dependencies.json beside its style.css — no PHP — or through the method/plugin_dependencies filter.

How it works

• method_collect_plugin_dependencies() (lib/theme-setup.php) reads wp-dependencies.json from get_template_directory() and get_stylesheet_directory() — de-duplicated, so a site running Method directly reads one file — skipping files that are missing, unreadable, or not a JSON array.
• The merged list passes through the method/plugin_dependencies filter. Entries without a slug are dropped and the list is de-duplicated by slug, later entries replacing earlier ones: child theme over parent, filter over both.
• method_run_plugin_dependencies() runs on after_setup_theme: it loads vendor/autoload.php, registers the list with WP_Dependency_Installer::instance( get_template_directory() ) and calls run(). It returns quietly if the autoloader is missing, the class unavailable, or the list empty, so a checkout without vendor/ degrades to “no dependency management”, not a fatal.
• On the Plugins screen a required plugin is labelled Required Plugin and loses its Deactivate and Delete links. Optional plugins ("required": false) show a notice instead; dismissal lasts a week.

The file

Method’s own file declares CMB2. slug is the plugin’s main file path, not its directory. Supported hosts are wordpress, github, bitbucket, gitlab, gitea and direct (a zip URL). For a git host, uri is the short owner/repo form and branch picks the branch; a private repository also takes a token.

[
    {
        "name": "CMB2",
        "host": "wordpress",
        "slug": "cmb2/init.php",
        "uri": "https://wordpress.org/plugins/cmb2/",
        "required": true
    }
]

From a child theme

[
    {
        "name": "My Plugin",
        "host": "github",
        "slug": "my-plugin/my-plugin.php",
        "uri": "pixelwatt/my-plugin",
        "branch": "main",
        "required": true
    },
    {
        "name": "Safe SVG",
        "host": "wordpress",
        "slug": "safe-svg/safe-svg.php",
        "uri": "https://wordpress.org/plugins/safe-svg/",
        "required": false
    }
]

From PHP

add_filter( 'method/plugin_dependencies', function ( array $deps ) {
    $deps[] = array(
        'name'     => 'Regenerate Thumbnails',
        'host'     => 'wordpress',
        'slug'     => 'regenerate-thumbnails/regenerate-thumbnails.php',
        'uri'      => 'https://wordpress.org/plugins/regenerate-thumbnails/',
        'required' => false,
    );
    return $deps;
} );

One limit: run() also reads the parent theme’s file itself, and in WPDI’s registry a required entry always replaces an existing one for the same slug, so a child theme or filter can add dependencies or change optional ones but cannot make CMB2 optional.

Changelog