The allow-plugins setting is a list in composer.json of Composer plugins permitted to run. Added in Composer 2.2.0, it defaults to an empty list, so no plugin runs until you approve it. That matters because a plugin executes code inside Composer itself, during install.
What a plugin is
A Composer plugin is a package of type composer-plugin that changes or extends Composer's behaviour. The documentation says plugin packages are loaded automatically as soon as they are installed, and plugins can hook into Composer events and receive access to Composer's internal state. In plain terms, a plugin runs PHP on the machine doing the install, whether that is a laptop or a build server.
What happens by default
| Situation | Behaviour |
|---|---|
| Interactive run, new plugin not listed | Composer prompts you to allow or deny it |
| Non-interactive run (CI), new plugin not listed | Composer fails, so the decision is not made silently |
| Plugin marked plugin-optional (Composer 2.5.3 and later) | Can be skipped in non-interactive mode |
| Setting is false | All plugins disallowed |
| Setting is true | All plugins allowed, which the docs say is not recommended |
How to review a plugin before you allow it
- Find out which package asks. Composer names it in the prompt or error.
- Ask whether you need it. Many plugins exist for convenience, such as coding standards setup.
- Read the package source, especially its activate method and event subscribers.
- Check who maintains it and how recent the releases are.
- Add it to allow-plugins by name, and commit that change in a pull request that reviewers can see.
composer config allow-plugins.vendor/plugin-name true
composer install --no-plugins
The second command is useful when a plugin misbehaves: the docs say the no-plugins option disables all installed plugins so you can still update or remove one.
Keep the list short
Every entry is code you chose to run at install time. Treat the list like a permissions file. Review additions as carefully as new runtime dependencies, and remove entries when you drop the package.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings are tracked to a decision, the same discipline an allow list needs.
Where Safeguard fits
Safeguard's SBOM and dependency scanning reads composer.lock and Gemfile.lock and flags known advisories. A free scan takes a few minutes.
Quick check
Does allow-plugins cover scripts in composer.json?
No. It governs plugins. Scripts in the root composer.json are a separate mechanism, and the docs say only the root package's scripts run.
Should I set allow-plugins to true to stop the prompts?
No. The Composer docs advise against it, because it approves every present and future plugin.
Sources
Last reviewed: 19 October 2026.
