{"record":{"id":"48fc4546a968d634","repo":"composer/composer","slug":"advisory-for-packagename-could-not-be-loaded-as","errorCode":null,"errorMessage":"Advisory for ${packageName} could not be loaded as a full advisory from ${repoName}\n${data}","messagePattern":"Advisory for (.+?) could not be loaded as a full advisory from (.+?)\n(.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Composer/Repository/PackageRepository.php","lineNumber":97,"sourceCode":"        return Preg::replace('{^array }', 'package ', parent::getRepoName());\n    }\n\n    public function hasSecurityAdvisories(): bool\n    {\n        return count($this->securityAdvisories) > 0;\n    }\n\n    public function getSecurityAdvisories(array $packageConstraintMap, bool $allowPartialAdvisories = false): array\n    {\n        $parser = new VersionParser();\n\n        $advisories = [];\n        foreach ($this->securityAdvisories as $packageName => $packageAdvisories) {\n            if (isset($packageConstraintMap[$packageName])) {\n                $advisories[$packageName] = array_values(array_filter(array_map(function (array $data) use ($packageName, $allowPartialAdvisories, $packageConstraintMap, $parser) {\n                    $advisory = PartialSecurityAdvisory::create($packageName, $data, $parser);\n                    if (!$allowPartialAdvisories && !$advisory instanceof SecurityAdvisory) {\n                        throw new \\RuntimeException('Advisory for '.$packageName.' could not be loaded as a full advisory from '.$this->getRepoName() . PHP_EOL . var_export($data, true));\n                    }\n\n                    if (!$advisory->affectedVersions->matches($packageConstraintMap[$packageName])) {\n                        return null;\n                    }\n\n                    return $advisory;\n                }, $packageAdvisories)));\n            }\n        }\n\n        return ['advisories' => array_filter($advisories, static function ($adv): bool { return \\count($adv) > 0; }), 'namesFound' => array_keys($advisories)];\n    }\n\n    public function hasFilter(): bool\n    {\n        return count($this->filter) > 0;\n    }","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/composer/composer/blob/c435d285c9120efdca35696769c72ea9fdcc0466/src/Composer/Repository/PackageRepository.php#L79-L115","documentation":"PackageRepository (the inline `package` repo type) can carry inline `security-advisories`. When getSecurityAdvisories() runs with allowPartialAdvisories=false, each advisory must upgrade from PartialSecurityAdvisory to a full SecurityAdvisory (i.e. have all required fields). If it cannot, the offending data is exported and thrown (src/Composer/Repository/PackageRepository.php:96-97).","triggerScenarios":"Defining a `package` repository with `security-advisories` entries missing required fields (e.g. no affectedVersions, no link/title) and then running an advisory audit that disallows partial advisories.","commonSituations":"Hand-authoring inline advisories for testing and omitting a required field, or copy-pasting an advisory shape that worked only as partial data.","solutions":["Ensure every inline advisory has the full set of required fields (at minimum: packageId/affectedVersions and a link or reportedAt).","Cross-check the field names against Composer's SecurityAdvisory schema.","If partial advisories are acceptable in your flow, pass allowPartialAdvisories=true where the API supports it."],"exampleFix":"// before\n\"security-advisories\": {\"vendor/pkg\": [{\"advisoryId\": \"X\", \"title\": \"RCE\"}]}\n\n// after - add affectedVersions\n\"security-advisories\": {\"vendor/pkg\": [{\"advisoryId\": \"X\", \"title\": \"RCE\", \"affectedVersions\": \">=1.0,<1.2\", \"link\": \"https://example.com/X\"}]}","handlingStrategy":"validation","validationCode":"// Validate inline advisory entries have the fields needed for a full advisory\n$required = ['advisoryId','affectedVersions'];\nforeach ($advisories as $pkg => $list) {\n    foreach ($list as $a) {\n        foreach ($required as $r) {\n            if (!isset($a[$r])) {\n                throw new \\UnexpectedValueException(\"Advisory for $pkg missing $r\");\n            }\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try { $repo->getSecurityAdvisories($map, false); }\ncatch (\\RuntimeException $e) { /* the exported $data shows which field is missing */ }","preventionTips":["Author inline advisories against the SecurityAdvisory schema (affectedVersions required for full advisories).","Test inline advisory config in isolation before relying on it.","Pass allowPartialAdvisories=true only when you intentionally tolerate partial data."],"tags":["composer","package-repository","security-advisories","config"],"backgroundTag":null,"analyzedSha":"c435d285c9120efdca35696769c72ea9fdcc0466","analyzedAt":"2026-08-07T18:58:23.525Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}