M2.4 Exception throwing while executing composer require: Higher matching version 2.3.x of xxx/module-xxxx was found in public repository packagist

Question

While executing composer require xxxx/module-xxxx I'm facing below error on the console. Repository is private at the moment.

[Exception]                                                                                                                                    

Higher matching version 2.4.x of xxx/module-xxxx was found in public repository packagist.org  than 2.3.x in private https://repo.magento.com. 

Public package might've been taken over by a malicious entity,

please investigate and update package requirement to match the version from the private repository   

Answer 1

The error is caused by the 'magento/composer-dependency-version-audit-plugin' module. This module forces composer to prioritize private repositories over public repositories. And seems to also sometimes causes errors while unzipping modules.

The workaround is to just not install this plugin.

Answer 2

When you have a module with a same name at packagist.org and at magento marketplace, and the first is newer than the second, this error will happen. This is caused by magento/composer-dependency-version-audit-plugin module, as explained in the official docs.

This may happen when you don't upload the newest version to the marketplace or they are taking too long to approve your submission.

I found at least 3 ways to workaround the issue, but another user here gave a 4th and better option (see solution #4):

Solution 1: install the latest version from Adobe's Marketplace

Just add --no-plugins to your composer require command.

For example: composer require ricardomartins/pagseguro --no-plugins.

This will ignore the above module execution and it will not check against packagist for newer versions. This way the above message will not be displayed.

Solution 2: Manually install the latest version

It's not really a solution, but if you really need the latest version from Packagist or Git, you may want to move the module to the app/code folder and remove it from composer dependencies (composer remove package/module).

Solution 3: Tell composer Magento is not a canonical repo

This way, if a newer version is available at packagist, it will be installed.

To do this, open composer.json file and add "canonical": false to Magento's repository, like follows:

  "repositories": [
        {
            "type": "composer",
            "url": "https://repo.magento.com/",
            "canonical": false
        }
    ]

Solution 4 🏆: To exclude offending package from the repository.

You can also exclude the package-vendor/module-name from the repo.magento.com repository

"repositories": {
    "0": {
        "type": "composer",
        "url": "https://repo.magento.com/",
        "exclude": ["package-vendor/module-name"]
    }
}

Thus, running composer require package-vendor/module-name will always pick up the latest Packagist release.

(answer provided by @Julien Loizelet)

---

Further reading (in Portuguese): I wrote a help article about this for the users of my PagSeguro module for Magento facing the same issue.

Answer 3

If the offending package comes from Packagist, this worked for me

"repositories": {
    "packagist.org": {
        "type": "composer",
        "url": "https://packagist.org",
        "exclude": ["package-vendor/module-name"]
    },

Answer 4

I ran into this issue trying to install mageplaza/module-smtp on Ubuntu 20.04. I am not 100% sure why but it turned out composer was installed using apt-get. I removed it and re-installed and the module installed with no issue.

sudo apt-get remove composer

Then install composer

cd ~
curl -sS https://getcomposer.org/installer -o composer-setup.php
HASH=`curl -sS https://composer.github.io/installer.sig`
php -r "if (hash_file('SHA384', 'composer-setup.php') === '$HASH') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
alias composer='/usr/local/bin/composer'