The plugin can't be installed on Composer based sites where vendor folder is not public

[andergmartins]

Expected Behavior

Users should be able to install the plugin using composer, even on sites where the vendor folder is not public. That is actually a good practice, and we should not be incompatible with that.

One example of that are sites based on https://roots.io/bedrock/.

Current Behavior

Users actually can install the plugin using composer, but some features will break. The features that rely on assets files coming from the vendor folder, like:

• the library wordpress-reviews
• the library wordpress-version-notices
• the Pro plugin requiring the free plugin as a composer requirement

Those asset files will not be found, because they are inside vendor, which is not public, so there is no public URL for it.

Those files (CSS, JS, images) will return 404 error.

Possible Solution

An option is to use/create a new library to handle those assets. The library could load the asset and store a public cache for them. CSS, JS, images, would be added to the wp-content folder, as a cache. The plugin and libraries would require a public endpoint that links to the library and returns the cached asset content.