← Feed

Posts

• View post

  Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. Composer 2.11 includes several security fixes, block-scope support for custom dependency policies, OSC 7501 terminal progress reporting and faster and more memory efficient dependency resolution. Full blog post: https://blog.packagist.com/composer-2-11-release/ #php #phpc #composerphp #supplychains...

• View post

  Packagist turns 15 🎉 On September 27, 2011, monolog/monolog became package ID 1. Today Packagist lists more than 469,000 packages, and Composer has installed packages from it more than 200 billion times. Our anniversary post covers how it all started, 15 years of milestones, the growth we've seen in 2026, and what comes next for supply chain security and funding. https://blog.packagist.com/15-years-of-packagist-over-200-billion-package-installs/ #php #phpc #composerphp #opensource

• View post

  Composer & Packagist now have a formal sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia. Our costs are primarily staff: operations, support, emergency response, maintenance and development. We ask enterprises profiting from the PHP ecosystem to pay their fair share to keep our shared critical infrastructure available to all PHP developers. https://blog.packagist.com/announcing-the-composer-packagist-sponsorsh...

• View post

  We're excited to announce @upsun@mastodon.social is now sponsoring Composer & Packagist maintenance, operations and development! Upsun is a great platform to run PHP applications and they have a long history in the PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem. If your company wants to still become a launch partner for our sponsorship program this week, reach out to sponsoring@packagist.org. #php #phpc #co...

• View post

  CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈 Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way: https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/ #php #phpc #composerphp #github #githubactions #supplychainsecurity

• View post

  📌 Stable versions on Packagist are now immutable. Once a version is published, the git commit it points to can no longer change. Retags are blocked and deleted versions are now marked with a reason and recoverable, if unmodified. Every change is recorded on the package's public transparency log. All details on our blog: https://blog.packagist.com/immutable-versions-on-packagist/ #php #phpc #composerphp

• View post

  We hope you enjoyed @glaubinix talk on the malware filtering features in Composer 2.10 at phpday. Try them out on latest snapshots today. Appreciate early feedback! Proud to sponsor @phpday in Verona, Italy! Slides at https://glaubinix.github.io/talks/2026-05-15-Composer-2-10-Malware-Filtering.html #php #phpc #phpday #composerphp #supplychainsecurity #malware

• View post

  Three months of Private Packagist updates: Malware filter list support is already in place, ahead of Composer 2.10's release next week. Flagged versions show warning banners on package pages and are marked in the version list. Permissions views on package level, better background job & sync visibility, and a narrower GitLab OAuth scope (read_api). https://blog.packagist.com/whats-new-in-private-packagist-may-2026-update/ #php #phpc #composerphp

• View post

  RE: https://phpc.social/@packagist/116566852406125489 If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc

• View post

  🔒 An update on Composer & Packagist supply chain security: Covering what's in place today, what ships this week with Composer 2.10 (dependency policies, stable version immutability), what's coming next (mandatory MFA, minimum-release-age policy, organizational package ownership), and the long-term direction toward immutable artifacts with SLSA provenance and sigstore attestations. If you maintain PHP packages, please enable MFA now. https://blog.packagist.com/an-update...

• View post

  🛡️ Blog: How Composer's download fallback behavior can silently override security decisions at the repository side, and what we are doing about it. If Private Packagist refuses to serve a malware-flagged version, Composer can fall back to the original GitHub URL, or even clone from source. Two new Private Packagist options close both fallback paths, regardless of the Composer version your developers and CI happen to be running. https://blog.packagist.com/closing-composers-download-fallbac...

• View post

  ⛔ Composer dependency policies block flagged malware by default, but only on 2.10. A project disabling the policy, or a CI image running Composer 2.4, still installs flagged versions normally until we can manually pull it from Packagist. Private Packagist now refuses to serve dist files for malware-flagged versions at the repository level, regardless of the Composer version requesting them. Enabled by default for new and existing organizations. https://blog.packagist.com/blocking-malware-downl...

• View post

  The Composer CLI is part of your supply chain. Older versions miss the protections shipped in 2.10 (dependency policies, malware feed integration, source fallback off by default) and carry known client-side CVEs. Private Packagist customers can now enforce which Composer client versions are allowed to talk to their Composer repository, with a clear upgrade message shown in the developer's terminal when an outdated client tries to connect. https://blog.packagist.com/enforce-a-safe-compo...

• View post

  🚨 Security advisory: Composer 2.9.8 and 2.2.28 (LTS) fix a vulnerability that lead Composer to leak GitHub Actions GITHUB_TOKENs and GitHub App installation tokens into job logs. GitHub's new ghs_<id>_<JWT> token format fails Composer's validation regex; the rejected token is printed into the error message and secret masking does not reliably catch it. Update now or disable affected Actions workflows. https://blog.packagist.com/composer-2-9-8-and-2-2-2...

• View post

  Bitbucket Cloud is retiring app passwords in favor of API tokens. If you're using Private Packagist with Bitbucket Cloud, migrate now to avoid future disruptions. This blog post explains it step-by-step: https://blog.packagist.com/bitbucket-deprecated-app-passwords/ #php #composerphp #phpc #privatepackagist #bitbucket

• View post

  New in Private Packagist: Usage Tracking can now help prioritize security updates by showing how dependencies cascade through projects and where vulnerable versions are used. Trusted Publishing for GitHub Actions and better synchronization setup. https://blog.packagist.com/whats-new-in-private-packagist-november-update/ #php #phpc #composerphp

• View post

  In Amsterdam next week and part of a group underrepresented at tech confs, or can't afford a ticket? Private Packagist is sponsoring @symfony Con (Nov 27th/28th) and we have a ticket to give away: Reply your favorite PHP8.5 feature to win #php #phpc #symfony #symfonycon

• View post

  🚀 Private Packagist February update: Redesigned login flow, team member MFA resets for org owners, new Microsoft Teams Workflow notifications (old connectors deprecated), clickable composer search URLs in your terminal https://blog.packagist.com/whats-new-in-private-packagist-february-2026-update/ #composerphp #php #phpc

• View post

  🚨 Composer 2.9.6 and 2.2.27 are out with fixes for CVE-2026-40261 and CVE-2026-40176, both command injection issues in the Perforce driver. Run composer self-update now. No exploitation detected on Packagist.org and Private Packagist. Details on our blog: https://blog.packagist.com/composer-2-9-6-perforce-driver-command-injection-vulnerabilities/ #php #phpc #composerphp

• View post

  Search on Packagist is currently unavailable due to large amounts of bot traffic that Algolia did not filter out. They now blocked packagist. UI search and the search API are affected. We are looking into temp workarounds till Algolia resolves our support request from yesterday.

• View post

  Private Packagist is a member of the @opensourcepledge & gave over $4k/FTE in 2025 to #opensource maintainers. Have your company join too! https://blog.packagist.com/private-packagist-2025-contributions-for-the-open-source-pledge/ - Reach out if you want to be a launch partner for our Composer&Packagist.org sponsorship program! #composerphp #php #phpc

• View post

  Together with PyPI, Maven Central, crates.io and other major package registries we signed a statement on sustainable open source infrastructure. 3B+ installs/month and evolving #composerphp and packagist.org requires sharing the costs. Our Blog: https://blog.packagist.com/a-call-for-sustainable-open-source-infrastructure/ Open Letter: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/ #phpc #php #supplychainsecurity #opensourcesus...

• View post

  After Composer 2.9 CLI security improvements, we're working on a transparency log for Packagist org to strengthen PHP supply chain security, funded by the Sovereign Tech Agency with help of the PHP Foundation and Private Packagist. #php #phpc #composerphp More detail about what we're working on can be viewed on our blog at https://blog.packagist.com/strengthening-php-supply-chain-security-with-a-transparency-log-for-packagist-org/

• View post

  RE: https://phpc.social/@thephpf/115655437049835617 Proud to announce we just renewed our annual $18,000 sponsorship for the The PHP Foundation! Check out this summary on all the work completed in 2025. So much more could be accomplished, if more businesses relying on PHP contributed too. Sign up as a sponsor and help moving PHP forward!