composer/composer · error · RuntimeException

The http protocol for github is not available anymore, updat

Error message

The http protocol for github is not available anymore, update your config's github-protocols to use "https", "git" or "ssh"

What it means

Composer throws this when the 'github-protocols' config option resolves to 'http' as the first (preferred) protocol. The 'http' protocol for GitHub was removed for security reasons (plaintext credentials/traffic). The check runs in Config::process() for the 'github-protocols' key: if secure-http is on, 'git' is stripped, and if 'http' is then the first remaining entry, the error fires. Only 'https', 'git', and 'ssh' are permitted.

Source

Thrown at src/Composer/Config.php:513

                    // convert string value to bool
                    return $env !== 'false' && (bool) $env;
                }

                if (!in_array($this->config[$key], [true, false, 'stash'], true)) {
                    throw new \RuntimeException(
                        "Invalid value for 'discard-changes': {$this->config[$key]}. Expected true, false or stash"
                    );
                }

                return $this->config[$key];

            case 'github-protocols':
                $protos = $this->config['github-protocols'];
                if ($this->config['secure-http'] && false !== ($index = array_search('git', $protos))) {
                    unset($protos[$index]);
                }
                if (reset($protos) === 'http') {
                    throw new \RuntimeException('The http protocol for github is not available anymore, update your config\'s github-protocols to use "https", "git" or "ssh"');
                }

                return $protos;

            case 'autoloader-suffix':
                if ($this->config[$key] === '') { // we need to guarantee null or non-empty-string
                    return null;
                }

                return $this->process($this->config[$key], $flags);

            case 'audit':
                $result = $this->config[$key];
                $abandonedEnv = $this->getComposerEnv('COMPOSER_AUDIT_ABANDONED');
                if (false !== $abandonedEnv) {
                    if (!in_array($abandonedEnv, ListPolicyConfig::AUDITS, true)) {
                        throw new \RuntimeException(
                            "Invalid value for COMPOSER_AUDIT_ABANDONED: {$abandonedEnv}. Expected one of ".implode(', ', ListPolicyConfig::AUDITS)."."

View on GitHub (pinned to 6ffc117740)

Solutions

1. Run `composer config github-protocols https` (or include "ssh"/"git") to replace http with https.
2. Edit composer.json "config" -> "github-protocols" and change "http" to "https" (e.g. ["https", "ssh"]).
3. For global config: `composer config -g github-protocols https`.
4. Remove the github-protocols key entirely so Composer uses the secure defaults.

Example fix

// before (composer.json)
"config": { "github-protocols": ["http", "https"] }
// after
"config": { "github-protocols": ["https", "ssh"] }

// Validate github-protocols before reading the config
$protos = $config->get('github-protocols');
$allowed = ['https', 'git', 'ssh'];
foreach ($protos as $p) {
    if (!in_array($p, $allowed, true)) {
        throw new \InvalidArgumentException("Unsupported github protocol '$p'. Allowed: " . implode(', ', $allowed));
    }
}

// type-guard is not applicable; this is a config-value validation
function isValidGithubProtocols(array $protos): bool {
    return empty(array_diff($protos, ['https', 'git', 'ssh']));
}

try {
    $protos = $config->get('github-protocols');
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), 'http protocol for github')) {
        // auto-fix the config then retry
        $source->setConfigSetting('github-protocols', ['https', 'ssh']);
        $protos = $config->get('github-protocols');
    } else { throw $e; }
}

When it happens

Trigger: Calling $config->get('github-protocols') (directly or transitively via any install/update/require command) when the config contains "github-protocols": ["http", ...] or when "github-protocols": ["git", "http"] with "secure-http": true (git gets stripped, leaving http first). Also triggered via `composer config github-protocols http`.

Common situations: Carrying over an old composer.json from a pre-2.x Composer era where http was allowed. Setting github-protocols globally via `composer config -g github-protocols http`. Copy-pasting a config snippet from an outdated tutorial.

Related errors

• Your configuration does not allow connections to {url}. See
• Your configuration does not allow connections to {url}. See
• Invalid value for COMPOSER_AUDIT_ABANDONED: {abandonedEnv}.
• The checksum verification of the file failed (downloaded fro
• You must enable the openssl extension to download files via

AI-assisted analysis of composer/composer@6ffc117740 (2026-08-07). Data as JSON: /api/errors/e6588664895dfd58. Report an issue: GitHub.