PHPackages                             k2gl/composer-license-gate - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. k2gl/composer-license-gate

ActiveComposer-plugin[Utility & Helpers](/categories/utility)

k2gl/composer-license-gate
==========================

Composer plugin that checks your dependencies' licenses against an allow/deny policy and can fail the install on a violation

1.0.1(1mo ago)0488↑32.1%3MITPHPPHP >=8.1CI passing

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/k2gl/composer-license-gate)[ Packagist](https://packagist.org/packages/k2gl/composer-license-gate)[ Docs](https://github.com/k2gl/composer-license-gate)[ RSS](/packages/k2gl-composer-license-gate/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (6)Versions (3)Used By (3)

composer-license-gate
=====================

[](#composer-license-gate)

A Composer plugin that checks your dependencies' licenses against an allow/deny policy as they're installed — and, in enforce mode, **fails the install** on a violation. It runs inside Composer's install/update lifecycle, so a disallowed license (say, GPL creeping into a proprietary product through a transitive dependency) is caught automatically in local installs and in CI, without a separate command to remember.

Unlike report-only license checkers you invoke by hand, this is a gate: the policy lives in `composer.json` and is enforced on every `composer install` and `composer update`.

Install
-------

[](#install)

```
composer require --dev k2gl/composer-license-gate
```

Configure
---------

[](#configure)

All configuration lives under `extra.k2gl-license-gate` in your root `composer.json`:

```
{
  "extra": {
    "k2gl-license-gate": {
      "mode": "enforce",
      "allow": ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC"],
      "deny": ["GPL-*", "AGPL-*"],
      "allow-packages": ["acme/legacy-thing"],
      "require-license": false
    }
  }
}
```

- **`mode`**
    - `warn` (default) — report violations but don't stop.
    - `enforce` — fail the install when a package violates the policy.
    - `off` — do nothing.
- **`allow`** — an allow-list. If set, a package is accepted only when *every*declared license matches one of these patterns. Takes precedence over `deny`.
- **`deny`** — a deny-list. A package is rejected if *any* declared license matches one of these.
- **`allow-packages`** — package names (`vendor/name`) exempt from the check, for the odd dependency you've reviewed and accepted.
- **`require-license`** — treat a package that declares no license as a violation.

Patterns are SPDX identifiers, matched case-insensitively, with a trailing `*` as a prefix wildcard — `GPL-*` matches `GPL-2.0-only`, `GPL-3.0-or-later`, and so on.

Use **either** `allow` (a strict whitelist — safest) **or** `deny` (block known-bad licenses, permit the rest). If both are set, `allow` wins.

What you'll see
---------------

[](#what-youll-see)

Under `enforce`, a violation aborts the install:

```
  ! license policy: acme/widget — license "GPL-3.0-or-later" is denied by policy

```

Under `warn`, the same line is printed but the install continues.

Notes
-----

[](#notes)

- A dual-licensed package (e.g. `MIT OR GPL-3.0`) is read conservatively: if any of its licenses is disallowed, it's flagged. Accept it deliberately with `allow-packages` once you've confirmed you're using it under the allowed option.
- Checks run per package as Composer installs or updates it, so only the packages actually being changed are checked — a full audit happens naturally on a clean `composer install`.

Requirements
------------

[](#requirements)

- PHP 8.1+
- Composer 2 (`composer-plugin-api ^2.0`)

License
-------

[](#license)

MIT

###  Health Score

42

—

FairBetter than 88% of packages

Maintenance90

Actively maintained with recent releases

Popularity17

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

48d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6bc4aa529c7f13ea593297497f6eae20d5c07f476baa0a551960d7e6ff1e5413?d=identicon)[k2gl](/maintainers/k2gl)

---

Top Contributors

[![k2gl](https://avatars.githubusercontent.com/u/2846079?v=4)](https://github.com/k2gl "k2gl (4 commits)")

---

Tags

compliancecomposer-pluginlicensespdxsupply-chainlicensespdxAuditcomposer-plugindependenciescompliancePolicy

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/k2gl-composer-license-gate/health.svg)

```
[![Health](https://phpackages.com/badges/k2gl-composer-license-gate/health.svg)](https://phpackages.com/packages/k2gl-composer-license-gate)
```

###  Alternatives

[drupal/core-composer-scaffold

A flexible Composer project scaffold builder.

5346.5M600](/packages/drupal-core-composer-scaffold)[vaimo/composer-patches

Applies a patch from a local or remote file to any package that is part of a given composer project. Patches can be defined both on project and on package level. Optional support for patch versioning, sequencing, custom patch applier configuration and patch command for testing/troubleshooting added patches.

3044.7M30](/packages/vaimo-composer-patches)[drupal/core-project-message

Adds a message after Composer installation.

2125.4M213](/packages/drupal-core-project-message)[mnsami/composer-custom-directory-installer

A composer plugin, to help install packages of different types in custom paths.

1435.5M65](/packages/mnsami-composer-custom-directory-installer)[phpro/grumphp-shim

GrumPHP Phar distribution

284.9M348](/packages/phpro-grumphp-shim)[arokettu/composer-license-manager

License management plugin for Composer

62226.9k](/packages/arokettu-composer-license-manager)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)