eiriksm

PHP / Composer / Drupal, beer nerd and JavaScript fan. I also maintain the PHP update service

[eiriksm @orkj]

Woah this team is really shipping stuff these days 😎🚀

[Packagist @packagist]

The Composer CLI is part of your supply chain. Older versions miss the protections in 2.10 and carry known CVEs of their own.

Private Packagist customers can now enforce which Composer client versions can talk to their repository.

#php #phpc #composerphp

[Packagist @packagist]

⛔ Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp

[Jordi Boggiano @seldaek]

Composer 2.10 is out.

Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.

#php #phpc #composerphp

[eiriksm @orkj]

It's that feeling that makes me remember why I love open source. Someone took the library I made to "beep out" communication from the Casio mod "sensor watch" and made a totp browser extension https://t.co/LoxQXDVCSd

And an input paste extension too!

So cool ❤️

[eiriksm @orkj]

Can't imagine there will be any AI remarks to such a solid PR though 🤔

[eiriksm @orkj]

I mean I could say this automatic review ruins the fun in my side project here, but I choose to focus on how little of these constellation of words we usually get in PR reviews. More unicorn focus please 🙏🦄 #ai

[eiriksm @orkj]

@ultimike Oh my what a missed opportunity for a cool gif #gifsMatter

[eiriksm @orkj]

You can have 1 attempt at guessing what time the #Drupal security advisory was published. Don't know what people are sweating about with these, I make the @violinist_io bot sweat for me instead 🤓✌️

[eiriksm @orkj]

Not really breaking much sweat with a #drupal core update. PR set to auto merge 20 minutes before the advisory came out 😎 @violinist_io saves so much time, also when time matters #PHP

[eiriksm @orkj]

@opdavies Very honoured to be the first returning guest :) See you in Barcelona next week?

[eiriksm @orkj]

@nmdmatt This is totally amazing and possibly quite revolutionary. 🔥💪 I have so many ideas! Let's talk wasm and d-beat over some craft beer in Barcelona if I make it 🤓

[eiriksm @orkj]

@steinmb More relevant here, instead of supply Chain attack... the security hole of a chain saw attack? 🤔

[eiriksm @orkj]

Currently in a docker container in a ec2 instance in a session manager session from my home computer on a tailscale ssh connection from my phone in a sleeping bag in a hammock hanging from trees in Bymarka #hardToKeepTrack

[eiriksm @orkj]

Wonder how many of the proposals for @DrupalConEur will fall into one of these categories:

A) About AI / LLM
B) Abstract generated by chat gpt
C) About AI / LLM and the abstract is generated by chat gpt

Happy reading and good luck to the committee 🤓🤞

[eiriksm @orkj]

@nmdmatt It does indeed not. Very common use case for the module

[eiriksm @orkj]

@nmdmatt And for that reason I would recommend https://t.co/t94uQy571z for the bundle case 🤓✌️🚀

[eiriksm @orkj]

@nmdmatt Just to point out: this might be overkill in some cases. Say you have 2 product types. Cookies and aprons. And your display shows aprons. New cookies come in all the time, but aprons rarely change. Then you might invalidate the apron list faaaar too often

[eiriksm @orkj]

@faroit @peter_szilagyi @Aldekein @github @travisci I got a reply for my support ticket about the same. Does indeed seem like actual suspicious activity, and I got more details from them there. My token was not a Travis token, but a token I am pretty sure was entered as a secret in Travis 🤔

[eiriksm @orkj]

@_vsChris Great news! You can help! https://t.co/OiI7xcWlIr

[eiriksm @orkj]

@saschaeggi @chumillas @LauriEskola @mikeherchel @gaborhojtsy Hey! Congrats! I was curious about the source of this image? Is it from a presentation? 🤓