Composer "Failed to download ... 404" - Missing Dist Archives in CI

Composer asked for a specific dist archive and the server answered 404 Not Found. The exact version your lockfile pins no longer exists at that URL - a tag was deleted, the package was yanked, or a mirror is briefly out of sync.

What this error means

A download step fails with "Failed to download" and an HTTP 404 for one package, while the rest install fine. It can be a permanent removal or a transient mirror gap that clears on retry.

  - Downloading acme/legacy-lib (1.4.2)
Failed to download acme/legacy-lib from dist: The "https://repo.packagist.org/
.../acme-legacy-lib-1.4.2.zip" file could not be downloaded (HTTP/2 404)
Now trying to download from source instead

Common causes

The pinned tag was deleted or yanked

A maintainer removed the exact version your composer.lock references. The dist URL 404s permanently, and re-running will not fix it.

A transient mirror gap

Packagist mirrors can briefly lack an archive that exists upstream. The 404 clears on retry once the mirror catches up.

How to fix it

Retry once to rule out a mirror gap

If a mirror was momentarily out of sync, a retry (Composer also falls back to source) succeeds.

composer clear-cache
composer install --no-interaction --prefer-dist

Re-pin to an existing version

If the tag is genuinely gone, update the constraint to a version that still exists and re-lock.

composer require acme/legacy-lib:^1.4.3
git add composer.json composer.lock && git commit -m "Re-pin acme/legacy-lib"

Fall back to a source install for the package

When only the dist is missing, install that package from its VCS source.

composer install --no-interaction --prefer-source

How to prevent it

• Mirror critical dependencies to a private Composer registry to survive upstream deletions.
• Commit composer.lock and review dependency removals before they hit CI.
• Cache the Composer cache so previously fetched archives remain available.

Related guides