Prevent plugin updates with backend

Back in OCv1 there was an option in backend to prevent plugins updates.

Is this also possible with OCv3 ?

I want to keep Rainlab.User plugin in version 2 but backend is offering update to version 3 whenever I run any updates from backend.

PS: I have many sites on shared hosting without access to composer.

Best regards,


Hey @jan-vince

We’re working on an interface for this, but to lock a plugin to prevent updates, set it to a specific version in the composer.json file:

"rainlab/translate-plugin": "2.2.8"

Note the value 2.2.8 will strictly request v2.2.8 and won’t allow anything else.

I hope this helps.

Hi @daft and thank you,

I have tried this earlier, but it is not working for me.

I have used "rainlab/translate-plugin": "v2.1.0"and backend is still trying to update User plugin.

But if you plan to add UI for this in backend, no need to waste time on this now.

Can you show what you have for the user plugin?


Backend screen:

And composer.json:

    "name": "october/october",
    "description": "Built using October CMS: The Laravel-Based CMS Engineered For Simplicity",
    "type": "project",
    "homepage": "",
    "license": "proprietary",
    "require": {
        "php": "^8.0.2",
        "october/rain": "^3.0",
        "laravel/framework": "^9.0",
        "october/all": "^3.0",
        "rainlab/user-plugin": "v2.1.0",
        "rainlab/blog-plugin": "^1.7",
        "rainlab/pages-plugin": "^2.0",
        "rainlab/sitemap-plugin": "^1.2",
        "vojtasvoboda/errorlogger-plugin": "^1.1",
        "janvince/smallextensions-plugin": "^1.21",
        "janvince/smallcontactform-plugin": "^1.67",
        "vdlp/oc-redirect-plugin": "^3.1",
        "janvince/smallgdpr-plugin": "^1.27",
        "webula/smallbackup-plugin": "^1.5",
        "romanov/clearcachewidget-plugin": "^1.3",
        "offline/oc-site-search-plugin": "^1.7",
        "inetis/dump-plugin": "^1.0"
    "require-dev": {
        "phpunit/phpunit": "^8.5|^9.0"
    "scripts": {
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        "post-create-project-cmd": [
            "php artisan key:generate --ansi"
        "post-autoload-dump": [
        "post-update-cmd": [
        "pre-package-uninstall": [
        "test": [
            "phpunit --stop-on-failure"
    "config": {
        "preferred-install": "dist",
        "allow-plugins": {
            "composer/installers": true
    "autoload": {
        "psr-4": {
            "App\\": "app",
            "System\\Console\\": "modules/system/console"
    "minimum-stability": "stable",
    "prefer-stable": true,
    "repositories": {
        "octobercms": {
            "type": "composer",
            "url": "",
            "only": ["october/*", "*-plugin", "*-theme"]

Try this

"rainlab/user-plugin": "2.1.*",

Oh I see, yes the interface will always tell you about updates, even though it is locked. This is what we are working on.

1 Like