🛡️ Blog: How Composer's download fallback behavior can silently override security decisions at the repository side, and what we are doing about it. If Private Packagist refuses to serve a malware-flagged version, Composer can fall back to the original GitHub URL, or even clone from source. Two new Private Packagist options close both fallback paths, regardless of the Composer version your developers and CI happen to be running. https://blog.packagist.com/closing-composers-download-fallback-paths-in-private-packagist/ #php #phpc #composerphp