{"record":{"id":"4f6690f7c1df141f","repo":"composer/composer","slug":"package-global-suffix-contains-a-composer-plugi","errorCode":null,"errorMessage":"{package}{global_suffix} contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe.\nYou can run \"composer {global_prefix}config --no-plugins allow-plugins.{package} [true|false]\" to enable it (true) or disable it explicitly and suppress this exception (false)\nSee https://getcomposer.org/allow-plugins","messagePattern":"(.+?)(.+?) contains a Composer plugin which is blocked by your allow-plugins config\\. You may add it to the list if you consider it safe\\.\nYou can run \"composer (.+?)config --no-plugins allow-plugins\\.(.+?) \\[true\\|false\\]\" to enable it \\(true\\) or disable it explicitly and suppress this exception \\(false\\)\nSee https://getcomposer\\.org/allow-plugins","errorType":"exception","errorClass":"PluginBlockedException","httpStatus":null,"severity":"error","filePath":"src/Composer/Plugin/PluginManager.php","lineNumber":821,"sourceCode":"                        return $allow;\n\n                    case '?':\n                    default:\n                        $attempts++;\n                        $this->io->writeError([\n                            'y - add package to allow-plugins in composer.json and let it run immediately',\n                            'n - add package (as disallowed) to allow-plugins in composer.json to suppress further prompts',\n                            'd - discard this, do not change composer.json and do not allow the plugin to run',\n                            '? - print help',\n                        ]);\n                        break;\n                }\n            }\n        } elseif ($optional) {\n            return false;\n        }\n\n        throw new PluginBlockedException(\n            $package.($isGlobalPlugin || $this->runningInGlobalDir ? ' (installed globally)' : '').' contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe.'.PHP_EOL.\n            'You can run \"composer '.($isGlobalPlugin || $this->runningInGlobalDir ? 'global ' : '').'config --no-plugins allow-plugins.'.$package.' [true|false]\" to enable it (true) or disable it explicitly and suppress this exception (false)'.PHP_EOL.\n            'See https://getcomposer.org/allow-plugins'\n        );\n    }\n}\n","sourceCodeStart":803,"sourceCodeEnd":828,"githubUrl":"https://github.com/composer/composer/blob/6ffc1177404d0c50119c22dde6564a380f4a82c9/src/Composer/Plugin/PluginManager.php#L803-L828","documentation":"Thrown as PluginBlockedException by PluginManager when a Composer plugin package is not permitted by the 'allow-plugins' config and cannot be authorized interactively. Composer 2.2+ requires explicit opt-in for every plugin package; in non-interactive mode (or after the interactive prompt is exhausted/answered 'discard') the run aborts here.","triggerScenarios":"A dependency that ships a Composer plugin is being installed/loaded, the package is not listed (or is set false) under config.allow-plugins, and either the IO is non-interactive, the prompt was answered 'd' (discard), or the prompt exceeded 5 failed attempts (lines 767-825).","commonSituations":"Fresh 'composer install' in CI/containers (non-interactive) where composer.json predates allow-plugins; requiring a plugin-providing package (e.g. symfony/flex, composer/ca-bundle-aware tools, phpstan/extension-installer) for the first time; Composer 2.2 upgrade where allow-plugins was retroactively required.","solutions":["Run the exact command from the message: composer config --no-plugins allow-plugins.<package> true (or 'composer global config ...' for global plugins).","Or add the package to config.allow-plugins in composer.json as true.","If you intentionally never want it, set it to false to suppress the exception.","For CI, pre-seed allow-plugins in composer.json so no interactive prompt is needed."],"exampleFix":"// before (composer.json - no allow-plugins)\n{\n  \"require\": { \"symfony/flex\": \"^2\" }\n}\n// after\n{\n  \"require\": { \"symfony/flex\": \"^2\" },\n  \"config\": { \"allow-plugins\": { \"symfony/flex\": true } }\n}","handlingStrategy":"validation","validationCode":"// Pre-seed allow-plugins before running composer non-interactively\n$ composer config allow-plugins.symfony/flex true\n// or assert in PHP before install\n$cfg = json_decode(file_get_contents('composer.json'), true);\n$plugin = 'symfony/flex';\nif (!isset($cfg['config']['allow-plugins'][$plugin])) {\n    throw new \\RuntimeException('allow-plugins missing '.$plugin);\n}","typeGuard":"function pluginIsAllowed(string $composerJson, string $plugin): bool\n{\n    $cfg = json_decode((string) file_get_contents($composerJson), true);\n    return is_array($cfg) && ($cfg['config']['allow-plugins'][$plugin] ?? false) === true;\n}","tryCatchPattern":"use Composer\\Plugin\\PluginBlockedException;\ntry {\n    // run composer operation that loads plugins\n} catch (PluginBlockedException $e) {\n    fwrite(STDERR, $e->getMessage());\n    // parse package from message and add to allow-plugins\n}","preventionTips":["Pre-populate config.allow-plugins in composer.json for all plugin packages.","Run composer install in CI with --no-interaction only after allow-plugins is set.","Add a CI check asserting every require'd plugin appears in allow-plugins."],"tags":["plugins","configuration","security","allow-plugins"],"analyzedSha":"6ffc1177404d0c50119c22dde6564a380f4a82c9","analyzedAt":"2026-08-07T00:01:08.491Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}