🔒 An update on Composer & Packagist supply chain security: Covering what's in place today, what ships this week with Composer 2.10 (dependency policies, stable version immutability), what's coming next (mandatory MFA, minimum-release-age policy, organizational package ownership), and the long-term direction toward immutable artifacts with SLSA provenance and sigstore attestations. If you maintain PHP packages, please enable MFA now. https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/ #php #phpc #composerphp