Maarten Bode

lead software engineering @zonneplan - building

[Maarten Bode @maartenbode]

@wesbos @syntaxfm Building Pricore, a self-hosted private Composer registry for PHP. Host your own packages without relying on third-party services. Open source, with a managed cloud option too. https://t.co/kN1jVwcB66

[Maarten Bode @maartenbode]

Pricore v0.50 introduces Security Auditing for your private PHP packages. Automatic vulnerability scanning, severity breakdowns, email notifications, and native composer audit support.

https://t.co/rN1PYYQbKe

[Maarten Bode @maartenbode]

This complements the existing GitHub, GitLab, and Bitbucket integrations. Repos spread across multiple providers and a self-hosted Gitea? Connect them all to the same Pricore organization.

One Composer endpoint to rule them all 🤘

https://t.co/7Ozl7SqPiA

[Maarten Bode @maartenbode]

Pricore v0.47.0 adds Generic Git support.
Beyond GitHub, GitLab, and Bitbucket, you can now connect any Git repository accessible via SSH or HTTPS. Gitea, Forgejo, Gogs, bare repos on your own server: it all works. Add the URL, Pricore handles the rest.

[Maarten Bode @maartenbode]

For private repos, Pricore generates Ed25519 key pairs in your organization settings. Copy the public key, add it as a deploy key, done. Keys are encrypted at rest and never shown in the UI. Read-only by design, Pricore only clones and fetches.
Webhooks keep packages in sync automatically with flexible auth (Bearer token, custom header, or query parameter).

[Maarten Bode @maartenbode]

Setup takes less than a minute. Mirrors sync every 4 hours automatically, only processing new or changed versions. Manual sync available anytime.
Available now, self-hosted and on Pricore Cloud.

[Maarten Bode @maartenbode]

Just shipped Registry Mirrors in Pricore v0.48.0.

Connect external Composer registries (Satis, commercial packages, paid WordPress plugins) and import everything into your Pricore organization. One endpoint, one access token. No more juggling multiple repositories or distributing credentials.

https://t.co/jb2vKsNWvF

[Maarten Bode @maartenbode]

Enable dist mirroring and Pricore downloads + stores the zip archives from the upstream registry locally. Your developers don't need any credentials to the original source. Configure it once, Pricore handles upstream authentication for them.
Huge for teams using commercial packages or paid plugins.

[Maarten Bode @maartenbode]

https://t.co/dSzVoRXfmo if you want to check it out. Open-source, Apache 2.0.

[Maarten Bode @maartenbode]

Presented Pricore for the first time at the Dutch Laravel Foundation Meetup in Apeldoorn last Thursday. 50+ developers in the room.

[Maarten Bode @maartenbode]

@pascalbaljet talked about Inertia.js 3. Pricore runs on Inertia, so those new features go in next week. Laravel 13 just dropped too. That's the thing about building on Laravel. The ecosystem moves, and your product moves with it.

[Pascal Baljet @pascalbaljet]

Next up is @maartenbode showing Pricore

[Maarten Bode @maartenbode]

wp engine acquired wpackagist today. composer is clearly becoming the default in wordpress.

wpackagist mirrors free plugins though. if you’re distributing premium plugins or managing private packages across client sites, you still need your own registry.

that’s what i’m building with pricore
https://t.co/vsvlZME5Jc

[WP Engine @wpengine]

We've acquired WPackagist.

If you use Composer to manage WordPress plugins and themes, you probably already know it. Now it's part of the WP Engine family.

WPackagist enables developers to install and manage WordPress plugins and themes using Composer, the PHP dependency manager. Millions of requests every week with thousands of developers relying on it daily.

It's essential infrastructure for modern development on WordPress software.

WPackagist joins Local, ACF, WP Migrate, and WP Offload Media in our developer tools lineup.

We believe that ensuring the stability and reliability of critical developer infrastructure is essential to the WordPress ecosystem.

Big thanks to @outlandish for building and maintaining @wpackagist for over a decade. We're proud to carry it forward.

Read more: https://t.co/CyKmTbpTzA

[Maarten Bode @maartenbode]

⚡ Average Composer package (6.6 MB, 2.4 MB compressed) fetched in under 1 second from R2. 2.4 MB downloaded with a total time of 733ms including DNS, TLS, and a redirect.

[Maarten Bode @maartenbode]

Migrated Pricore Cloud's package mirroring to Cloudflare R2 this morning. Zero egress fees, faster package resolution from Cloudflare's edge.

5 organizations are already using Pricore Cloud for private packages and mirroring. Early access is open.

https://t.co/dSzVoRXfmo

[Maarten Bode @maartenbode]

spent a good chunk of today on pricore ui details. members page, git credentials, sidebar icons, spacing, text sizes. none of it is exciting on its own but together it's starting to feel like a proper product.
check out pricore at https://t.co/kZaX3E77FD

[Maarten Bode @maartenbode]

few updates to pricore, the private composer registry. pricore now has a command palette. cmd+k and you're wherever you need to be: orgs, packages, repos, settings. the feature that makes everything else faster.

[Maarten Bode @maartenbode]

replaced the sync log table in pricore with something that actually tells you what happened. status icons, duration, how many versions were added, updated, or removed.