PHP error guide
Composer allow-plugins blocked plugin: meaning and fix
Error summary
Allow only the reviewed plugin package by exact name. Composer 2.2+ refuses plugin execution without an explicit trust decision.
What it means
Allow only the reviewed plugin package by exact name. Composer 2.2+ refuses plugin execution without an explicit trust decision.
What the error means
This message means that Composer 2.2+ refuses plugin execution without an explicit trust decision. The exact signature distinguishes composer allow-plugins blocked plugin from a generic application failure.
Why PHP produces it
The engine or service reports “Composer allow-plugins blocked plugin” because its required precondition was not met. Allow only the reviewed plugin package by exact name.
PHP version notes
The composer allow-plugins blocked plugin wording here is based on Composer 2.x; punctuation and exception class names can differ on older branches or vendor builds.
Most common causes
- The immediate input or configuration reaches the specific condition: Composer 2.2+ refuses plugin execution without an explicit trust decision
- The code path assumes the prerequisite for composer allow-plugins blocked plugin has already been satisfied.
- For composer allow-plugins blocked plugin, development and production differ in version, extension, permissions, paths, or service configuration.
- An earlier operation returned an unchecked value that is consumed by the line reporting composer allow-plugins blocked plugin.
Minimal examples
BAD — reproduces the problem
composer config allow-plugins true
FIXED — safer pattern
composer config allow-plugins.acme/installer true
Step-by-step diagnosis
- Copy the complete “acme/installer contains a Composer plugin which is blocked by your allow-plugins config.” text and retain the first application stack frame.
- Reproduce composer allow-plugins blocked plugin in the same SAPI and environment listed for this page.
- Before changing composer allow-plugins blocked plugin, inspect the preceding value or directive and verify its type, path, version, and permissions.
- Apply the narrow correction—allow only the reviewed plugin package by exact name—then repeat the original request once.
Fixes
Correct the failing prerequisite
Allow only the reviewed plugin package by exact name
composer config allow-plugins.acme/installer true
Fail explicitly at the boundary
Validate the condition before the operation that emits composer allow-plugins blocked plugin, and log a safe diagnostic without credentials or full production paths.
Common mistakes when fixing it
- Suppressing composer allow-plugins blocked plugin instead of correcting its upstream condition.
- Testing composer allow-plugins blocked plugin only with the CLI binary when the failing request runs under FPM or Apache.
- Changing a global setting for composer allow-plugins blocked plugin before confirming the site-specific effective configuration.
How to prevent it
- Add a focused test that exercises the boundary responsible for composer allow-plugins blocked plugin.
- Keep runtime versions, extensions, configuration, and deploy artifacts affecting composer allow-plugins blocked plugin reproducible.
- Validate external data and service return values before they can trigger composer allow-plugins blocked plugin.
Web server / environment notes
cli, composer, linux, docker. The failure occurs where composer 2.2+ refuses plugin execution without an explicit trust decision
Tags: cli,composer,linux,docker