PHP Package Repo for #ComposerPHP https://nitter.cf/t.co/4Hmg2DUaba - https://nitter.cf/t.co/1HbpYeFtTB open source - https://nitter.cf/t.co/3n71fBpwcG private packages. @packagist@phpc.social
The Internets
Joined April 2011
- Tweets803
- Following3
- Followers8.5K
- Likes227
Packagist retweeted
Cooldown now works for WordPress plugins and themes too! WP Packages records when it first serves each version, and resets the clock if a release is changed after the fact on WordPress.org
roots.io/wp-packages-now-sup…
ALT Terminal running "composer update wp-plugin/query-monitor -vv" with a cooldown policy enabled. Composer reports "2 package version(s) withheld by the cooldown policy": wp-plugin/query-monitor 4.1.0, published 2026-10-26, available in 4 days, and wp-plugin/query-monitor 4.1.1, published 2026-10-27, available in 4 days 11 hours.
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
Packagist retweeted
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
We're excited to welcome @sentry to our sponsor program as part of their investment in open source infrastructure! We rely on responsible businesses like @sentry to maintain and operate the infrastructure behind the PHP ecosystem. Join them: packagist.org/sponsor/
Packagist retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Packagist retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Packagist retweeted
As we've said before, Longhorn PHP wouldn't be possible without our sponsors - thanks to @packagist, @The_Guarantors and @vehikl for helping make Longhorn PHP 2026 happen!
Packagist retweeted
Applications for The PHP Foundation contractors for 2027 are now open! We are looking for help in certain areas but we are open to your ideas as well. Application period ends on October 20, 2026. Apply now! thephp.foundation/blog/2026/…
#phpc #php
ALT screenshot of the php source code from github
Packagist turns 15 years old and has served more than 200 billion package installs 🎉
A look back at how Composer and Packagist started, 15 years of milestones, 2026 AI growth and what comes next.
blog.packagist.com/15-years-…
#php #phpc #composerphp
We're super excited for #SymfonyCon 2026 in Warsaw Nov 26-27 and happy to sponsor again! A must-go for anyone working with PHP and #Symfony. Great content, fantastic people. Now more than ever: educate yourself and keep with ecosystem & tech in general.
#php #phpc #composerphp
Malware detection and strict dependency policies🔒
Catch Nils Adermann & Jordi Boggiano at SymfonyCon Warsaw 2026 for a look inside Packagist's security overhaul and best practices for your stack symfony.com/blog/symfonycon-…
New in Private Packagist, August '26 update: Organization-wide supply chain security controls, MFA enforcement for CLI access, GitLab subgroup sync, artifact packages for suborgs via API, and more complete audit logging.
blog.packagist.com/whats-new…
#php #phpc #composerphp
Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors 🤝 @AikidoSecurity, @awscloud, @SocketSecurity, @BunnyCDN, @upsundotcom, @sonatype, @tideways, @datadog and @algolia for sharing this burden.
blog.packagist.com/announcin…
#php #phpc #composerphp
We're excited to announce @upsundotcom is now sponsoring #composerphp & Packagist maintenance, ops and development! They have a long history in the #PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem.
If your company wants to still become a launch partner for our sponsorship program this week, reach out to [email protected].
CI/CD pipelines are a prime target for supply chain attacks. We hardened the #GitHubActions workflows for Composer, Packagist and Private Packagist with #zizmor🌈, a GHA static analysis tool and wrote down how to the same for yours 👇 #php #phpc #composerphp
ALT Text: Securing our GitHub Actions workflows with zizmor - Private Packagist Visualization: GitHub shield graphic, with icons representing security, workflows, and analysis using the tool Zizmor.
Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
blog.packagist.com/securing-…
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: de.meet-magento.com/
#meetmagento #magento #meetmagentode #adobecommerce
📌 Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, deletions are tracked with a reason and recoverable, and everything is recorded on the public transparency log.
#php #phpc #composerphp
ALT Packagist: immutable Versions, featuring a shield and a tag labeled v1.2.3 with an arrow to a follow up commit indicated with a dot. The arrow is crossed out and blocked.
Full details on this change and consequences are blog.packagist.com/immutable…
