Composer 2: allow-plugins Config Deprecation / Plugin Blocked in CI
Composer 2.2 made plugin execution opt-in via config.allow-plugins. Builds that relied on the old implicit-trust behavior now emit a deprecation/blocked warning, and in non-interactive CI an unlisted plugin does not run - silently changing install behavior.
What this error means
Composer in CI warns that a plugin is not in allow-plugins (or that implicit plugin trust is deprecated), and a package's install-time behavior (a code-sniffer installer, a versions plugin) does not take effect. Locally you answered the interactive prompt once.
dealerdirect/phpcodesniffer-composer-installer contains a Composer plugin which
is currently not in your allow-plugins config. See
https://getcomposer.org/allow-plugins
Do you trust "dealerdirect/phpcodesniffer-composer-installer" ... [y/n] ?
# non-interactive CI -> resolves to "no" -> plugin skippedCommon causes
No explicit allow-plugins map
Without config.allow-plugins, Composer 2.2+ blocks plugins by default in CI and warns about the deprecated implicit-trust behavior.
The map exists but omits this plugin
A partial allowlist still blocks any plugin not explicitly listed, so its install-time effect silently disappears.
How to fix it
Declare an explicit allow-plugins map
List each trusted plugin with true so it runs non-interactively.
{
"config": {
"allow-plugins": {
"dealerdirect/phpcodesniffer-composer-installer": true,
"phpstan/extension-installer": true
}
}
}Allowlist via the CLI
composer config allow-plugins.phpstan/extension-installer trueAvoid the blanket allow
- List only the specific plugins you trust, each set to
true. - Avoid
"allow-plugins": trueexcept as a temporary measure. - Commit the change so CI and local behavior match.
How to prevent it
- Maintain an explicit, committed
allow-pluginsmap of trusted plugins. - Review and allowlist each new plugin by name before relying on it.
- Keep the map in composer.json so CI runs non-interactively without warnings.