Meta tags:
description=PHP Package Repositories for Composer;

Headings (most frequently used words):

packagist, composer, private, in, new, update, what, 2026, 2025, for, with, of, august, the, github, actions, on, across, your, organization, version, release, supply, chain, security, may, cve, open, source, org, 15, years, over, 200, billion, package, installs, announcing, sponsorship, program, securing, our, workflows, zizmor, immutable, versions, restricting, plugins, enforce, safe, blocking, malware, downloads, every, closing, download, fallback, paths, 10, an, and, 28, fix, token, disclosure, error, messages, fixes, perforce, driver, command, injection, vulnerabilities, 40261, 40176, contributions, pledge, february, november, strengthening, php, transparency, log, bitbucket, deprecated, app, passwords, call, sustainable, infrastructure, working, amasty, project, based, access, keys, shutdown, support, postponed, to, september, 1st,

Text of the page (most frequently used words):
the (63), composer (52), #packagist (46), and (36), #security (31), private (26), min (25), read (25), 2026 (24), supply (18), update (17), chain (17), org (16), 2025 (15), with (15), our (15), for (14), new (13), nils (13), adermann (13), this (13), are (12), release (11), post (10), over (9), improvements (9), steven (9), rombauts (9), version (9), series (9), that (8), package (8), malware (8), may (7), months (7), open (7), github (7), past (6), updates (6), what (6), changelog (6), access (6), more (6), source (6), bitbucket (6), from (6), packages (6), next (6), following (6), jul (5), support (5), today (5), app (5), php (5), supplychain (5), has (4), three (4), api (4), have (4), will (4), now (4), sep (4), here (4), your (4), passwords (4), jordi (4), blocking (4), shipped (4), actions (4), jun (4), closing (4), download (4), fallback (4), paths (4), stephan (3), vock (3), been (3), experience (3), significant (3), introduced (3), metadata (3), they (3), keys (3), specific (3), dependency (3), management (3), working (3), infrastructure (3), opensource (3), nov (3), boggiano (3), igor (3), benko (3), product (3), perforce (3), driver (3), cve (3), lists (3), behavior (3), downloads (3), every (3), across (3), organization (3), sponsor (3), monolog (3), about (2), focus (2), enhanced (2), user (2), let (2), february (2), you (2), discontinuing (2), one (2), additional (2), september (2), amasty (2), announced (2), accounts (2), project (2), better (2), few (2), discovery (2), most (2), make (2), secure (2), august (2), other (2), important (2), sustainable (2), together (2), usage (2), deprecated (2), their (2), token (2), change (2), using (2), provided (2), announce (2), repository (2), cli (2), advisories (2), features (2), which (2), subscriptions (2), but (2), highlights (2), latest (2), round (2), authentication (2), login (2), pledge (2), help (2), not (2), also (2), please (2), immediately (2), lts (2), running (2), phar (2), self (2), releases (2), fixes (2), command (2), injection (2), vulnerabilities (2), fix (2), tokens (2), changes (2), filter (2), last (2), introducing (2), policy (2), aikido (2), each (2), covers (2), worth (2), understanding (2), top (2), how (2), cover (2), safe (2), plugins (2), immutable (2), versions (2), covered (2), sponsorship (2), program (2), years (2), than (2), 200 (2), billion (2), imprint, privacy, terms, evolving, steadily, refined, dive, into, since, credentials, undergone, comprehensive, overhaul, standout, deadline, drawing, near, like, remind, soon, extending, original, timeline, month, give, teams, preparation, time, migrate, shut, down, shutdown, postponed, 1st, recently, starting, january, global, generated, products, tab, customer, instead, moving, provide, cleaner, tying, directly, based, busy, improving, improved, monitoring, tools, daily, workflow, smoother, joined, major, registries, signing, joint, statement, stewardship, maven, central, pypi, crates, vsx, openjs, foundation, openssf, alpha, omega, addressing, critical, challenge, growing, gap, between, call, favor, system, affects, organizations, cloud, workspace, synchronizations, stop, entirely, june, 9th, limited, functionality, pleased, bringing, lots, automatic, automatically, blocks, known, protection, enabled, default, prevents, accidentally, updating, week, client, were, funded, through, service, parallel, main, funding, sovereign, tech, strengthening, transparency, log, several, including, insights, tracking, page, introduction, trusted, publishing, artifact, deployment, audit, controls, november, feb, continued, evolve, flows, hardening, notification, capabilities, redesigned, registration, flow, completely, reworked, mar, third, year, member, fund, only, development, dependencies, rely, build, run, commercial, contributed, total, contributions, opensourcepledge, apr, include, two, vcs, affected, users, without, actively, 40261, 40176, vulnerability, where, leaks, full, contents, issued, github_tokens, installation, logs, disclosure, error, messages, focused, integrations, code, hosting, platforms, usability, throughout, rundown, notable, added, even, weeks, saw, increasing, amount, software, attacks, targeting, ecosystems, handful, these, hit, ecosystem, too, via, taken, stolen, attackers, publish, tags, excited, native, filtering, consolidated, future, proof, customizable, configuration, control, handling, abandoned, fast, detection, published, feature, recent, framework, substantial, step, forward, while, protections, try, best, older, enforce, enforcing, powerful, restricting, making, stable, earlier, posts, hardened, securing, workflows, zizmor, launching, formal, public, pages, getcomposer, want, start, thanking, companies, who, board, launch, aws, socket, bunny, upsun, sonatype, tideways, announcing, aug, large, batch, lot, attention, went, depth, highlight, 27th, 2011, submitted, got, fifteen, later, 469, 000, million, installed, times, alone, passed, installs, repositories, com, home,

Text of the page (random words):
private packagist home packagist com about private packagist php package repositories for composer opensource 15 years of packagist over 200 billion package installs on september 27th 2011 jordi submitted monolog monolog to packagist org it got package id 1 fifteen years later packagist org lists more than 469 000 packages with over 5 8 million versions and composer has installed packages from it more than 200 billion times monolog alone has passed one nils adermann jordi boggiano sep 29 2026 8 min read changelog what s new in private packagist august 2026 update we ve shipped a large batch of updates to private packagist over the past few months a lot of our attention went to supply chain security which we ve covered in depth in our supply chain security series in this post we ll highlight the other improvements steven rombauts aug 28 2026 3 min read packagist org announcing the composer packagist sponsorship program today we are launching a formal sponsorship program for composer and packagist org together with new public sponsor pages on packagist org sponsor and getcomposer org sponsor we want to start by thanking the companies who are on board at launch private packagist aikido aws socket bunny upsun sonatype tideways nils adermann jordi boggiano jul 30 2026 5 min read supplychain securing our github actions workflows with zizmor this is the next post in our supply chain security series following the supply chain security update the composer 2 10 release and immutable version metadata on packagist org the earlier posts covered composer behavior changes to packagist org and private packagist features today we ll cover how we hardened steven rombauts jul 23 2026 6 min read packagist org immutable versions on packagist this is the next post in our supply chain security series following the supply chain security update and the composer 2 10 release each post in this series covers a specific behavior worth understanding and a change we are making on top of it today stable version metadata on packagist nils adermann jul 7 2026 8 min read supplychain restricting composer plugins across your organization this is the next post in our supply chain security series following the supply chain security update the composer 2 10 release closing composer s download fallback paths blocking malware downloads for every composer version and enforcing a safe composer version across your organization composer plugins are a powerful steven rombauts jun 12 2026 7 min read supplychain enforce a safe composer version across your organization this is the next post in our supply chain security series following the supply chain security update the composer 2 10 release closing composer s download fallback paths and blocking malware downloads for every composer version while the protections we have shipped try their best to cover older composer nils adermann jun 4 2026 3 min read supplychain blocking malware downloads for every composer version in private packagist this is the next post in our supply chain security series following the supply chain security update the composer 2 10 release and the recent post on closing composer s download fallback paths composer 2 10 s dependency policy framework is a substantial step forward for php supply nils adermann jun 2 2026 5 min read supplychain closing composer s download fallback paths in private packagist this is the next post in our supply chain security series following the supply chain security update and the composer 2 10 release each post in this series covers a specific composer behavior worth understanding and a private packagist feature we are introducing on top of it today how composer nils adermann jun 1 2026 8 min read composer composer 2 10 release we are excited to announce the release of composer 2 10 0 introducing native malware filtering and consolidated future proof customizable dependency policy configuration to control the handling of security advisories abandoned packages and now malware fast detection of malware for packages published on packagist org is provided by aikido stephan vock nils adermann may 28 2026 7 min read composer an update on composer packagist supply chain security the last months and even more so the last weeks saw an increasing amount of software supply chain attacks targeting open source ecosystems a handful of these have hit the php ecosystem too via taken over github accounts and stolen access tokens that let attackers publish new tags on packages nils adermann igor benko may 27 2026 12 min read changelog what s new in private packagist may 2026 update over the past three months we ve shipped updates focused on security integrations with code hosting platforms and usability improvements throughout private packagist here s a rundown of the most notable changes support for malware filter lists we ve added support for malware filter lists to help igor benko may 18 2026 2 min read security composer 2 9 8 and 2 2 28 fix github actions token disclosure in error messages please immediately update composer to version 2 9 8 or 2 2 28 lts by running composer phar self update the new releases fix a vulnerability where composer leaks the full contents of github actions issued github_tokens or github app installation tokens to the github actions logs github introduced nils adermann may 13 2026 5 min read composer composer 2 9 6 fixes perforce driver command injection vulnerabilities cve 2026 40261 cve 2026 40176 please immediately update composer to version 2 9 6 or 2 2 27 lts by running composer phar self update the new releases include fixes for two command injection security vulnerabilities in the perforce vcs driver that also affected users without perforce and not actively using the driver cve 2026 nils adermann apr 14 2026 2 min read opensourcepledge private packagist 2025 contributions for the open source pledge this is now our third year as a member of the open source pledge private packagist subscriptions help fund not only the development of composer and packagist org but also the open source dependencies we rely on to build and run our commercial product in 2025 we contributed a total nils adermann mar 18 2026 1 min read changelog what s new in private packagist february 2026 update private packagist has continued to evolve over the past three months with significant improvements to authentication flows security hardening and notification capabilities here are the highlights from our latest round of product improvements redesigned login and registration flow we ve completely reworked the authentication experience to make login and stephan vock feb 9 2026 2 min read changelog what s new in private packagist november 2025 update we ve shipped several important updates to private packagist over the past three months including more insights on the package usage tracking page the introduction of trusted publishing for secure artifact deployment and enhanced security and audit controls here are the highlights from our latest round of product improvements steven rombauts nov 18 2025 2 min read opensource strengthening php supply chain security with a transparency log for packagist org the release of composer 2 9 this week introduced new security features on the composer cli client which were funded by private packagist through service subscriptions but in parallel we are working on security on the main php package repository at packagist org with additional funding from the sovereign tech igor benko steven rombauts nov 14 2025 2 min read composer composer 2 9 release we are pleased to announce the release of composer 2 9 0 bringing improvements to security repository management from the cli and lots more automatic security blocking composer now automatically blocks updates to packages with known security advisories this protection is enabled by default and prevents you from accidentally updating jordi boggiano nov 13 2025 2 min read private packagist bitbucket deprecated app passwords bitbucket announced that they deprecated app passwords in favor of their new api token system this change affects organizations using private packagist with bitbucket cloud bitbucket org workspace synchronizations bitbucket app passwords will stop working entirely on june 9th 2026 bitbucket s app passwords provided limited functionality and security steven rombauts sep 25 2025 2 min read opensource a call for sustainable open source infrastructure today we joined other major package registries in signing an important joint statement on sustainable stewardship of open source infrastructure together with maven central pypi crates io open vsx openjs foundation openssf and alpha omega we re addressing a critical challenge the growing gap between infrastructure usage and support nils adermann sep 23 2025 2 min read changelog what s new in private packagist august 2025 update we ve been busy improving private packagist over the past few months with a focus on package discovery user experience improvements and improved security monitoring tools here are the most significant updates that will make your daily workflow smoother and more secure better package discovery and management we steven rombauts sep 1 2025 2 min read private packagist working with amasty s new project based access keys amasty recently announced that starting january 1 2026 they will be discontinuing global composer access keys generated in the products tab of customer accounts instead they re moving to project specific access keys that provide better security and cleaner dependency management by tying composer access directly to steven rombauts jul 22 2025 3 min read composer packagist org shutdown of composer 1 x support postponed to september 1st 2025 with the deadline drawing near we d like to remind you that we are discontinuing composer 1 x support on packagist org soon we re extending our original timeline by one month to give teams additional preparation time to migrate composer 1 x metadata access will now shut down steven rombauts nils adermann jul 3 2025 1 min read changelog what s new in private packagist may 2025 update private packagist has been evolving steadily over the past three months with a focus on api improvements enhanced security and refined user experience let s dive into the significant updates that have been introduced since february api improvements our api credentials have undergone a comprehensive overhaul with the standout stephan vock may 13 2025 3 min read private packagist about terms privacy imprint