Composer "package is abandoned, you should avoid using it" in CI

By Daniel Zoghalchali·Latchkey

An abandoned notice is a warning, not an install failure: the maintainer flagged the package as no longer maintained and may suggest a replacement. Install still succeeds, but a strict composer audit can turn abandoned packages into a non-zero exit that fails CI.

What this error means

composer install prints "Package vendor/package is abandoned, you should avoid using it. Use replacement/package instead", and composer audit may exit non-zero for it.

Package fzaninotto/faker is abandoned, you should avoid using it.
Use fakerphp/faker instead.

Common causes

A dependency was marked abandoned upstream

The maintainer set "abandoned" in the package metadata, so Composer surfaces it on every install.

A strict audit gate treats abandoned as a failure

composer audit with abandoned-as-error exits non-zero when any installed package is abandoned.

How to fix it

Migrate to the suggested replacement

1. Read the "Use X instead" hint in the warning.
2. Replace the abandoned package with its maintained successor.
3. Relock and re-run.

composer remove fzaninotto/faker
composer require --dev fakerphp/faker

Control how audit treats abandoned packages

Choose whether abandoned packages are a report, a warning, or a failure in your audit step.

composer audit --abandoned=report

How to prevent it

• Replace abandoned dependencies with maintained forks promptly.
• Decide an explicit --abandoned policy for your audit step.
• Review abandoned notices during dependency upgrades.

Frequently asked questions

Related guides

References

• Composer documentation
• GitHub Actions documentation