composer/composer · error · \InvalidArgumentException

Invalid license provided: ${license}. Only SPDX license iden

Error message

Invalid license provided: ${license}. Only SPDX license identifiers (https://spdx.org/licenses/) or "proprietary" are accepted.

What it means

In InitCommand::interact the entered license is validated through Composer\Spdx\SpdxLicenses::validate (which checks the SPDX license list) and the literal string 'proprietary'. Anything failing both throws InvalidArgumentException, terminating the init. SPDX identifiers are case- and form-sensitive (e.g. Apache-2.0, MIT, BSD-3-Clause).

Source

Thrown at src/Composer/Command/InitCommand.php:370

        );
        if ($type === '' || $type === false) {
            $type = null;
        }
        $input->setOption('type', $type);

        if (null === $license = $input->getOption('license')) {
            if (!empty($_SERVER['COMPOSER_DEFAULT_LICENSE'])) {
                $license = $_SERVER['COMPOSER_DEFAULT_LICENSE'];
            }
        }

        $license = $io->ask(
            'License [<comment>'.$license.'</comment>]: ',
            $license
        );
        $spdx = new SpdxLicenses();
        if (null !== $license && !$spdx->validate($license) && $license !== 'proprietary') {
            throw new \InvalidArgumentException('Invalid license provided: '.$license.'. Only SPDX license identifiers (https://spdx.org/licenses/) or "proprietary" are accepted.');
        }
        $input->setOption('license', $license);

        $io->writeError(['', 'Define your dependencies.', '']);

        // prepare to resolve dependencies
        $repos = $this->getRepos();
        $preferredStability = $minimumStability ?: 'stable';
        $platformRepo = null;
        if ($repos instanceof CompositeRepository) {
            foreach ($repos->getRepositories() as $candidateRepo) {
                if ($candidateRepo instanceof PlatformRepository) {
                    $platformRepo = $candidateRepo;
                    break;
                }
            }
        }

View on GitHub (pinned to c435d285c9)

Solutions

1. Use the exact SPDX identifier from https://spdx.org/licenses/ (e.g. Apache-2.0, MIT, BSD-3-Clause).
2. Use 'proprietary' for closed-source code.
3. Leave the field blank if you do not want a license recorded.

Example fix

// before
composer init --license="Apache"
// after
composer init --license="Apache-2.0"

$spdx = new \Composer\Spdx\SpdxLicenses();
if ($license !== null && $license !== 'proprietary' && !$spdx->validate($license)) {
    throw new \InvalidArgumentException('Bad license');
}

function isValidLicense(string $l): bool {
    return $l === 'proprietary' || (new \Composer\Spdx\SpdxLicenses())->validate($l);
}

When it happens

Trigger: User enters a license that is neither a valid SPDX identifier nor the word 'proprietary' — e.g. `Apache`, `GPL3`, `free`, or a custom description.

Common situations: Typing a short/informal license name instead of the SPDX identifier; entering a version without the `-` (e.g. `GPL-3` vs `GPL-3.0-only`); copy-pasting a license nickname.

Related errors

• The package name %s is invalid, it should be lowercase and h
• The package name ${value} is invalid, it should be lowercase
• Invalid minimum stability "${value}". Must be empty or one o
• The src folder name "%s" is invalid. Please add a relative p
• Invalid email "${email}"

AI-assisted analysis of composer/composer@c435d285c9 (2026-08-07). Data as JSON: /api/errors/7eb86ed40296b333. Report an issue: GitHub.