Composer Limitations in Artifactory

JFrog Artifactory Documentation
Products
JFrog Artifactory
Content Type
User Guide

The following are the limitations of Composer in Artifactory:

  • Supported Versions: Composer 1.x is no longer supported on Packagist as of September 1, 2025. If you cannot upgrade to Composer 2.0, Artifactory will provide extended support for Composer 1.x in local repositories until December 2026.

    Composer 2.0 is required for remote and virtual repositories.

  • Repository Path: When accessing a Composer repository through Artifactory, the path must include /api/composer before the repository name. For example, https://company.jfrog.io/artifactory/api/composer/composer-virtual.

  • Limitation with JFrog Curation on Composer Remote Repositories: When a Composer remote repository is curated by JFrog Curation (requires Artifactory version 7.131+), installations based on source (--prefer-source) are not supported because these installations bypass the Curation block operations.