{"record":{"id":"67447052bbf5f86b","repo":"symfony/symfony","slug":"unable-to-use-expressions-as-the-symfony-expressio","errorCode":null,"errorMessage":"Unable to use expressions as the Symfony ExpressionLanguage component is not installed. Try running \"composer require symfony/expression-language\".","messagePattern":"Unable to use expressions as the Symfony ExpressionLanguage component is not installed\\. Try running \"composer require symfony/expression-language\"\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php","lineNumber":957,"sourceCode":"        $listener->replaceArgument(1, new Reference($userProvider));\n        $listener->replaceArgument(2, new Reference('security.user_checker.'.$id));\n        $listener->replaceArgument(3, $id);\n        $listener->replaceArgument(6, $config['parameter']);\n        $listener->replaceArgument(7, $config['role']);\n        $listener->replaceArgument(9, $stateless);\n        $listener->replaceArgument(11, $config['target_route']);\n\n        return $switchUserListenerId;\n    }\n\n    private function createExpression(ContainerBuilder $container, string $expression): Reference\n    {\n        if (isset($this->expressions[$id = '.security.expression.'.ContainerBuilder::hash($expression)])) {\n            return $this->expressions[$id];\n        }\n\n        if (!$container::willBeAvailable('symfony/expression-language', ExpressionLanguage::class, ['symfony/security-bundle'])) {\n            throw new \\RuntimeException('Unable to use expressions as the Symfony ExpressionLanguage component is not installed. Try running \"composer require symfony/expression-language\".');\n        }\n\n        $container\n            ->register($id, Expression::class)\n            ->addArgument($expression)\n        ;\n\n        return $this->expressions[$id] = new Reference($id);\n    }\n\n    private function createRequestMatcher(ContainerBuilder $container, ?string $path = null, ?string $host = null, ?int $port = null, array $methods = [], ?array $ips = null, array $attributes = []): Reference\n    {\n        if ($methods) {\n            $methods = array_map('strtoupper', $methods);\n        }\n\n        if ($ips) {\n            foreach ($ips as $ip) {","sourceCodeStart":939,"sourceCodeEnd":975,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php#L939-L975","documentation":"Thrown by SecurityExtension::createExpression() when the container reports that symfony/expression-language will NOT be available at runtime (ContainerBuilder::willBeAvailable returns false) while compiling an expression-based access rule or voter. Expressions in security require the ExpressionLanguage component; its absence makes expression config unusable, so compilation aborts.","triggerScenarios":"Using `allow_if` expressions in access_control, expression voters, or deny/allow expression config while symfony/expression-language is not installed or is registered as a dev-only package excluded from the compiled container's available packages.","commonSituations":"Adding an `allow_if` to access_control in a project without expression-language; expression-language required only in dev (so prod container compile fails); removing the component while leaving allow_if rules; willBeAvailable excluding it due to a version conflict.","solutions":["Install the component: composer require symfony/expression-language.","Ensure it is installed in the environment that compiles the container (avoid --no-dev if it is a dev requirement; better: make it a prod dependency).","Verify availability: composer show symfony/expression-language.","If you do not want the dependency, remove all allow_if / expression-based security config."],"exampleFix":"# before: security.yaml uses allow_if without the component\nsecurity:\n    access_control:\n        - { path: ^/admin, allow_if: \"'ROLE_ADMIN' in roles\" }\n# RuntimeException: Unable to use expressions as the Symfony ExpressionLanguage component is not installed...\n\n# after\n$ composer require symfony/expression-language","handlingStrategy":"validation","validationCode":"// Guard expression config on component presence before compiling\nif (!class_exists(\\Symfony\\Component\\ExpressionLanguage\\ExpressionLanguage::class)) {\n    foreach ($accessControl as $rule) {\n        if (!empty($rule['allow_if'])) {\n            throw new \\LogicException('allow_if requires symfony/expression-language; run composer require symfony/expression-language');\n        }\n    }\n}","typeGuard":"function expressionLanguageAvailable(): bool\n{\n    return class_exists(\\Symfony\\Component\\ExpressionLanguage\\ExpressionLanguage::class);\n}","tryCatchPattern":null,"preventionTips":["Require symfony/expression-language whenever allow_if or expression voters are used.","Keep it as a prod dependency so prod container compiles succeed.","Audit security config for allow_if before removing the component.","Validate config in CI with cache:clear --env=prod."],"tags":["security","dependencies","expression-language","configuration","access-control"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}