Igor Benko

Software engineer at @packagist

[Packagist @packagist]

⛔ Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp

[Jordi Boggiano @seldaek]

Composer 2.10 is out.

Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.

#php #phpc #composerphp

[Packagist @packagist]

🔒An update on Composer & Packagist supply chain security: what's in place, what ships this week with Composer 2.10 (dependency policies, immutable versions), and what comes next.
If you maintain PHP packages, enable MFA now!
#php #phpc #composerphp

[Packagist @packagist]

If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc

[Packagist @packagist]

Three months of Private Packagist updates: Malware filter list support already in place, ahead of Composer 2.10's release next week. Plus a new package permissions tab, better background job visibility, and a narrower GitLab OAuth scope. Link 👇
#php #phpc #composerphp

[Packagist @packagist]

🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php

[Nils Adermann @naderman]

Open infrastructure isn't free. 🌱
Packagist/Composer signed a joint @OpenSSF letter with PyPI, crates, Maven, CPAN, etc on real cost of running package registries.
#php #phpc #composerphp #softwaresupplychain #PreserveOpenSource #FreeSoftwareIsntFree #OpenSource #Sustainability

[Packagist @packagist]

🚀 Private Packagist February update: Redesigned login flow, team member MFA resets for org owners, new Microsoft Teams Workflow notifications (old connectors deprecated), clickable composer search URLs in your terminal #composerphp #php #phpc

[Packagist @packagist]

Proud to announce we just renewed our annual $18,000 sponsorship for the The PHP Foundation!

Check out this summary on the work completed in 2025. So much more could be accomplished, if all businesses using PHP contributed. Sign up as a sponsor and help moving PHP forward!

[Packagist @packagist]

In Amsterdam next week and part of a group underrepresented at tech confs, or can't afford a ticket? Private Packagist is sponsoring @symfonycon (Nov 27th/28th) and we have a ticket to give away: Reply your favorite PHP8.5 feature to win #php #phpc #symfony #symfonycon

[The PHP Foundation @ThePHPF]

PHP 8.5 Released! 🎉

In this new release we have:
– URI Extension
– Pipe Operator
– Clone With
– A new #[\NoDiscard] attribute
– Closures and first-class callables in constant expressions
– Persistent cURL share handles

Read all about it: https://t.co/RNfkvZSyHY

[Packagist @packagist]

New in Private Packagist: Usage Tracking page can now help prioritize security updates by showing how dependencies cascade through projects and where vulnerable versions are used. Trusted Publishing for GitHub Actions and better synchronization setup. #php #phpc #composerphp

[Packagist @packagist]

After Composer 2.9 CLI security improvements, we're working on a transparency log for https://t.co/Gf5b9WSQGV to strengthen PHP supply chain security, funded by the @sovtechagency with help of the @ThePHPF and Private Packagist. #php #phpc #composerphp

[Jordi Boggiano @seldaek]

Composer 2.9 is here! 🚀 It automatically blocks packages with known vulnerabilities, has a new repository command to manage repos from the CLI, and lots more!
#composerphp #phpc #PHP

[Packagist @packagist]

🚨 Warning to PHP package maintainers: We did not email you to change your passwords & 2FA. Emails asking you to update your credentials are a phishing attempt. We had the phishing site & domain taken down. If you got the email and entered your credentials, please contact us.

[Packagist @packagist]

Would you like to attend #APIPlatformCon 2025 in Lille on Sep 18/19 or online? Private Packagist is sponsoring: 4 tickets to give away! Part of a group underrepresented at tech conferences, or can't afford a ticket? Repost and reply favorite PHP package(s) #php #composerphp #phpc

[Packagist @packagist]

The era of Composer v1 finally comes to an end, long live Composer v2! 👑 Today https://t.co/WIMPyEqZA2 support for v1 metadata has been shut down as announced last year. https://t.co/ObJ9gMQUpz #composerphp #phpc #php

[Packagist @packagist]

August update: dependency usage tracking across your packages, automatic GitLab token rotation, and Conductor improvements with custom labels and smarter PR handling https://t.co/dK8qKNwPX8 #php #composer #composerphp #phpc

[Packagist @packagist]

🚨 https://t.co/Gf5b9WSQGV shutdown of Composer 1.x support postponed to September 1st, 2025. Act now, upgrade to Composer 2! Last resort: check out Private Packagist extended 1.x support if you really cannot migrate right now.

[Nils Adermann @naderman]

Meet @igorbenko and me at IPC in Berlin today & tomorrow at our @packagist booth. 👋 Would love to chat about Composer, supply chain security, dependencies, or show you our new tool Conductor! Don't forget to pick up a Composer sticker 😉

#php #phpc #composerphp #ipc #ipc2025