{"record":{"id":"6e18f6b0b461a886","repo":"composer/composer","slug":"advisory-for-name-could-not-be-loaded-as-a-full","errorCode":null,"errorMessage":"Advisory for {name} could not be loaded as a full advisory from {repoName}\n{data}","messagePattern":"Advisory for (.+?) could not be loaded as a full advisory from (.+?)\n(.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Composer/Repository/ComposerRepository.php","lineNumber":727,"sourceCode":"        // respect available-package-patterns / available-packages directives from the repo\n        if ($this->hasAvailablePackageList) {\n            foreach ($packageConstraintMap as $name => $constraint) {\n                if (!$this->lazyProvidersRepoContains(strtolower($name))) {\n                    unset($packageConstraintMap[$name]);\n                }\n            }\n        }\n\n        $parser = new VersionParser();\n        /**\n         * @param array<mixed> $data\n         * @param string $name\n         * @return ($allowPartialAdvisories is false ? SecurityAdvisory|null : PartialSecurityAdvisory|SecurityAdvisory|null)\n         */\n        $create = function (array $data, string $name) use ($parser, $allowPartialAdvisories, &$packageConstraintMap): ?PartialSecurityAdvisory {\n            $advisory = PartialSecurityAdvisory::create($name, $data, $parser);\n            if (!$allowPartialAdvisories && !$advisory instanceof SecurityAdvisory) {\n                throw new \\RuntimeException('Advisory for '.$name.' could not be loaded as a full advisory from '.$this->getRepoName() . PHP_EOL . var_export($data, true));\n            }\n            if (!$advisory->affectedVersions->matches($packageConstraintMap[$name])) {\n                return null;\n            }\n\n            return $advisory;\n        };\n\n        if ($this->securityAdvisoryConfig['metadata'] && ($allowPartialAdvisories || $apiUrl === null)) {\n            $promises = [];\n            foreach ($packageConstraintMap as $name => $constraint) {\n                $name = strtolower($name);\n\n                // skip platform packages, root package and composer-plugin-api\n                if (PlatformRepository::isPlatformPackage($name) || '__root__' === $name) {\n                    continue;\n                }\n","sourceCodeStart":709,"sourceCodeEnd":745,"githubUrl":"https://github.com/composer/composer/blob/6ffc1177404d0c50119c22dde6564a380f4a82c9/src/Composer/Repository/ComposerRepository.php#L709-L745","documentation":"During `composer audit`, ComposerRepository fetches security advisories and tries to build full SecurityAdvisory objects. If the repository returns advisory data that is missing required fields, PartialSecurityAdvisory::create() returns only a partial advisory, and when $allowPartialAdvisories is false (the default full-audit path) it throws RuntimeException, dumping the offending data via var_export. This indicates the advisory source returned incomplete or schema-violating data.","triggerScenarios":"Running `composer audit` against a repository that advertises security-advisories.metadata but returns advisory entries lacking fields required for a full advisory (e.g. missing cve, reportedAt, or affectedVersions constraint). The error fires inside getSecurityAdvisories() for each offending entry.","commonSituations":"A private/mirror repository with a buggy advisories feed; upstream advisory data that changed schema; partial mirror that strips fields. Usually not a client-config error but a data-quality problem on the repository side.","solutions":["Update Composer to the latest version in case a newer build tolerates the advisory schema.","Report the malformed advisory data to the repository operator (the dumped data shows which fields are missing).","Temporarily switch to a different advisory source (e.g. the default packagist security feed) if one repository is broken.","Pin the offending package out of the affected version range so the malformed advisory is no longer fetched."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $result = $repo->getSecurityAdvisories($map, false);\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), 'could not be loaded as a full advisory')) {\n        // advisory source returned incomplete data; log and continue without blocking\n        $result = ['namesFound' => [], 'advisories' => []];\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Keep Composer up to date so advisory-schema tolerances are current.","Prefer the default packagist advisory feed which is schema-stable.","If you run a private advisory feed, validate its output against the documented schema in CI."],"tags":["security","audit","advisory","repository","data-quality"],"analyzedSha":"6ffc1177404d0c50119c22dde6564a380f4a82c9","analyzedAt":"2026-08-07T00:01:08.491Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}