Skip to content

Disable source-fallback by default, mark it deprecated and remove env/flags to override#12885

Merged
Seldaek merged 2 commits into
composer:mainfrom
Seldaek:source-fallback-disable
May 28, 2026
Merged

Disable source-fallback by default, mark it deprecated and remove env/flags to override#12885
Seldaek merged 2 commits into
composer:mainfrom
Seldaek:source-fallback-disable

Conversation

@Seldaek
Copy link
Copy Markdown
Member

@Seldaek Seldaek commented May 27, 2026

This new config option was added in #12698 (which is not yet released), and while discussing security related things lately we have come to the conclusion that falling back from dist to source or vice versa can be problematic in some cases and we'd rather disable that.

So the source-fallback option is now disabled by default in 2.10, and set to be removed in 2.11 (always off).

While motivated by security concerns, it is a behavior change that may affect users tho so we want to keep the option in 2.10 as an easier way to transition/upgrade, and to give everyone a chance to voice concerns in case this is a behavior people really rely on.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 27, 2026

API Surface Changes

If any of the additions below are not intended as public API, mark them with @internal in the docblock.

Removed API Surface

Methods

Properties

Modified API Surface

Properties

Copy link
Copy Markdown
Collaborator

@glaubinix glaubinix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

Comment thread res/composer-schema.json Outdated
"source-fallback": {
"type": "boolean",
"description": "If true (default), Composer will fall back to a different installation source (e.g., from dist to source or vice versa) when a download fails. Set to false to disable this behavior."
"description": "DEPRECATED, will be removed in Composer 2.11. Defaults to false. If true, Composer will fall back to a different installation source (e.g., from dist to source or vice versa) when a download fails. Automatic source fallback has security implications, please open an issue at https://github.com/composer/composer/issues if you need this kept around."
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add "deprecated": true?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yeah good point thanks

@Seldaek Seldaek merged commit b902ec8 into composer:main May 28, 2026
22 checks passed
@Seldaek Seldaek deleted the source-fallback-disable branch May 28, 2026 08:25
@cs278
Copy link
Copy Markdown
Contributor

cs278 commented May 28, 2026

Is the PR that should be mentioned in the blog post?

Implementation in PRs #12698 and [second PR still missing]

https://blog.packagist.com/composer-2-10-release/#deprecating-source-fallback

@naderman
Copy link
Copy Markdown
Member

Haha thanks, like 5 people read that and nobody noticed.

@edalzell
Copy link
Copy Markdown

edalzell commented Jun 4, 2026

We often pull from a branch on a staging environment to run tests, how would we do that going forward?

@Seldaek
Copy link
Copy Markdown
Member Author

Seldaek commented Jun 4, 2026

Like you used to do? If there is a specific issue you'll have to be more specific :)

Maybe read up on #12889 first tho it has a few pointers already but I'm really not sure which solution is for you because your problem description is too vague

@edalzell
Copy link
Copy Markdown

edalzell commented Jun 4, 2026

Yup saw that discussion after, got it working by removing --prefer-dist from the composer command. Thanks for all you do on this!

@Seldaek
Copy link
Copy Markdown
Member Author

Seldaek commented Jun 4, 2026

Alright, are you also on GitLab or what's the environment? Could you share the exact error message you got?

I am thinking we may be able to detect the error combined with the presence of --prefer-dist and output a clearer hint in this case, but the more info I have to pinpoint it the more detailed output we can give (without risking to mislead people in a completely different scenario).

@edalzell
Copy link
Copy Markdown

edalzell commented Jun 4, 2026

Nope this is on Laravel Forge (https://forge.laravel.com). They used to have that as part of their composer command defaults. So I had copied that command around on all my sites lol. Easy to remove. A full error message, if it helps:

Failed to download transformstudios/prime from dist: The "https://api.github.com/repos/transformstudios/prime/zipball/55e9ad09083e30777053a49f2eae9091b0a2256d" file could not be downloaded (HTTP/2 404 ):
{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#download-a-repository-archive-zip","status":"404"}
    Source fallback is disabled. Not trying alternative sources.

Note this is a private repo

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants