Did not understand the following tool output: php-http/discovery contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe. See https://getcomposer.org/allow-plugins You can run "composer config --no-plugins allow-plugins.php-http/discovery [true|false]" to enable it (true) or keep it disabled and suppress this warning (false) (reported by composer-normalize)