I added a requirement for a non-silverstripe (jQuery) plugin to my (root) composer.json file. So SilverStripe automatically installs it in the /vendor directory. Unfortunately then loading any .js files will generate a 403 due to this line in .htaccess:

RewriteRule ^vendor(/|$) - [F,L,NC]

I could possibly add a composer requirement for a plugin that supports defining an installer path for individual packages, or maybe add an extra rewite rule to .htaccess for this specific package, but what would be the preferred Silvestripe way to do this? How is this supposed to work?

There was a bit of discussion about this a number of months back (when we were trialling a new tool for decision making) - might be work a read over, it is at https://www.loomio.org/d/0siznDgv/how-should-we-manage-front-end-dependencies

Thanks Cam, reading that I guess it's is a complex matter after all.

Just to be complete: updating from a composer file in mysite or another module does create a vendor folder in that module, that is accessible. I was amazed, though, at the amount of files a simple jQuery requirement for a jQuery plugin package got me, where I really ever only wanted the one plugin file... :)