Magento Marketplace plugin will not update (via Composer)

So you’ve installed a Magento Marketplace plugin but found out there was an update – you quickly open your ssh terminal and run the composer update command… but for some reason composer reports there are no updates. /annoyed .

I wanted to share with you a problem I faced recently installing the Magento 2 Dotmailer (Email Marketing) plugin update. This problem is not isolated to Dotmailer’s plugin – in fact it’s not even a problem with the plugin creator in most cases.

A long story short, I obtained the Dotmailer plugin via the Magento Marketplace. What this means is the account that you login to on the Magento Marketplace, will give composer access to plugins you have bought. Composer will obtain the download url by querying for that plugin.

By default plugins are sourced from Packagist by composer. The conversation between composer and a repository provider (i.e. Packagist, etc) may look like this:

Composer: Hey Packagist, buddy, my best friend… Do you know where I can download the plugin called gurdeep/plugin1?
Packagist: Hold on, let me check.
Packagist: Yes, the version I have registered is 1.0.2 and this is the url to download version 1.0.2 (sends url for 1.0.2)
Composer: Thanks Packagist, you’re the best.

Summary: Magento will try to download plugins via if you added them to your Marketplace account.

Why am I talking about anyway?

As I mentioned earlier:

By default plugins are sourced from Packagist by composer.

WRONG! (well not wrong). If you have no other repositories referenced in your projects composer.json file, Composer will query Packagist.

However since we’re talking about Magento – Magento has it’s repository referenced in the composer.json file (

In terms of Composer functionality, when you specify an additional repository in your projects composer.json file, composer will first request the package (plugin) from that repository – and if it can’t find it there, it will revert to Packagist.

So what’s the problem?

Since you purchased/obtained your plugin from the Magento Marketplace, this means when Composer connects to, will tell composer which version of the plugin to download and where to download it from:

Composer: Hey, buddy, my other best friend… Do you know where I can download the plugin called gurdeep/plugin1? Hold on, let me check. Yes, the version I have registered is 1.0.1 and this is the url to download version 1.0.1 (sends url for 1.0.1)

Umm? Why did Packagist say 1.0.2 and say 1.0.1?

If you think about this, when you run the composer update command, composer will query to see if there is a newer version of the plugin.

Composer will then download the version that returns. And if your composer.json did not have the repository declared, composer would have fetched the plugin/package from Packagist.

KEY POINT: requires authentication to download from it. This authentication is based on an Access Key associated with your Magento Marketplace  account – if you bought a plugin using your Marketplace account, you will be able to download that plugin from

Bear in mind that will only return the download url if your Magento Marketplace account has that plugin added to it (i.e. you buy a plugin, it’s then linked to your account, in other words you are getting a custom composer package list based on your Marketplace purchases).

So how do I fix this?

You don’t. It’s up to the plugin creator to ensure they have registered the latest version of their plugin on the Magento Marketplace ( You can send the plugin creator an email if you know for a fact they have an updated version available but Magento Marketplace does not have that version. Hopefully they will upload the update.

If you really need the updated version but can’t wait for to update:

Before you do this – check if the plugin you require is on Packagist ( – you can search for the plugin to make sure).

Solution 1 (preferred)

This solution should be considered as temporary. Revert this change once the plugin creator has updated Magento Marketplace with the latest version (by reverting this ensures that you continue to receive updates without manually maintaining the version in composer.json file).

Edit your projects composer.json (<Mage Install>/composer.json) and explicitly tell composer to require a very specific version of the plugin (in the “require” : { declaration):


“require” : { 
"gurdeep/plugin": "^1.0",


“require” : { 
"gurdeep/plugin": "1.0.2",

This will force composer to download the latest version, and download it from Packagist instead because it can’t find that version on

When you have made the change run the composer update command.

composer update
Solution 2

1 – Create a brand new Magento Marketplace account*, and create a new Access Key (do not purchase/obtain the same plugin on that account).

*If you register a new Marketplace Account, this means you will lose access to ALL your existing plugins!!

2 – Remove the current plugin via composer:

composer remove gurdeep/plugin1

3 – Clear the composer cache

composer clear-cache

4 – Update your auth.json file with your new Magento Marketplace Access Key (if you told composer to save your credentials)

The auth.json file is usually in the COMPOSER_HOME folder.

If you are using linux you can use this ssh/terminal command to find out where your COMPOSER_HOME folder is:

composer config --list --global | grep "\[home\]"

Openauth.jsonand replace the username & password with your new Access Key (public key = username / private key = password)

5 – Register the plugin with composer again

composer require gurdeep/plugin1

6 – Sit back and enjoy the output of ssh/terminal reporting composer downloading the latest version of the plugin.


Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.