8

Why when I run composer install using Composer 2, I'm receiving these messages below asking to "trust" the Composer plugins?

magento/magento-composer-installer contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "magento/magento-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
laminas/laminas-dependency-plugin contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "laminas/laminas-dependency-plugin" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
magento/inventory-composer-installer contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "magento/inventory-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
cweagans/composer-patches contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "cweagans/composer-patches" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
magento/magento-composer-installer contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "magento/magento-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
laminas/laminas-dependency-plugin contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "laminas/laminas-dependency-plugin" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
magento/inventory-composer-installer contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "magento/inventory-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] d
cweagans/composer-patches contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "cweagans/composer-patches" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?

Magento 2 Composer

How to solve it?

1

2 Answers 2

12

Composer 2.2 comes with a new security feature, it does not trust plugins by default unless you specify it in the composer file, in July 2022 plugins will no longer be executed if they aren't specified in the composer.json file.

The new Magento 2 version includes this feature in the composer.json, so you won't need to worry about it.

So, you have two options:

  • Downgrade Composer to < 2.2 version.
  • Update composer.json file accepting the request when running composer install.
{
    "config": {
        "allow-plugins": {
            "magento/*": true,
            "laminas/*": true,
            "cweagans/composer-patches": true
        }
    }
}
1
  • Composer just complains, without even logging what plugin was trying to run, so how should we know what to add to allow-plugins object???
    – Top-Master
    Commented Oct 8, 2022 at 2:23
1

Add the following in composer.json,

"allow-plugins": {
        "magento/magento-composer-installer": true,
        "magento/inventory-composer-installer": true,
        "laminas/laminas-dependency-plugin": true
    }

OR run following commands for whatever package the error is coming for,

composer config --no-plugins allow-plugins.magento/magento-composer-installer true

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.