Packagist Conductors

Package managers support our world's infrastructure, but those who build them have more work on their plate then ever. Companies who rely on this work for their revenue should give something back. It's in these companies' interest to keep this tech sustainable. And if your company is sponsoring Composer & Packagist, that counts towards Pledge membership, too.

Package registry sustainability is easy to support in principle. The more meaningful step is turning that support into action. Sonatype is both a steward of #MavenCentral and a beneficiary of the wider registry ecosystem. Becoming a launch sponsor of #Packagist's new sponsorship programme is part of recognising that responsibility. Infrastructure can be donated and traffic can be cached. The people operating, securing and improving these critical services still need to be funded. A worthwhile read from Brian Fox: https://lnkd.in/egsqjHAn

We are launching a sponsorship program for Composer & Packagist to spread the burden of operating this critical shared infrastructure for the PHP ecosystem across more enterprises. Thank you to our launch sponsors 🤝 Aikido Security, AWS, Socket, bunny.net, Upsun (formerly Platform.sh), Sonatype, Tideways GmbH, Datadog and Algolia. Why a sponsorship program? Composer and Packagist serve billions of package installs per year, and the pressures on package repositories keep growing: rising usage, more frequent and sophisticated supply chain attacks, and expanding compliance requirements. Our costs are primarily staff, not servers: • 24/7 operations and on-call • Support, from MFA lockouts to package name disputes • Emergency response to supply chain attacks • Maintenance work like bugs or code hosting platform API changes • Development, including our ongoing supply chain security roadmap Private Packagist covers more than half of these expenses, but one product cannot carry an entire ecosystem alone. We are asking the enterprises profiting from a functioning PHP ecosystem to pay their fair share, while Packagist stays free for individual developers and smaller companies. Link in the comments to the article which also includes a look ahead at how we are trying to transform the funding of package repositories together with other ecosystems. #php #phpc #composerphp

We're excited to announce Upsun (formerly Platform.sh) is now sponsoring Composer & Packagist maintenance, operations and development! Upsun is a great platform to run PHP applications and they have a long history in the PHP ecosystem and really show their commitment. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem. If your company wants to still become a launch partner for our sponsorship program this week, reach out to sponsoring@packagist.org. #php #phpc #composerphp #supplychainsecurity

CI/CD pipelines are a prime target in the software supply chain. A workflow file runs automatically on every push and pull request, often with write permissions and access to deployment and registry secrets. In the next post of our supply chain security series, we cover how we hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist using zizmor, a static analysis tool for GitHub Actions. The post walks through real attacks like the tj-actions/changed-files compromise, the zizmor rules that would have caught them, our configuration, and the pitfalls we ran into along the way. 🔒 Link in the comments! #php #phpc #composerphp #githubactions #github #supplychainsecurity

We're excited to sponsor the returning Meet Magento DE conference Oct 22nd, 2026 in Mainz, Germany! Hope to meet many of our customers and users in the Magento ecosystem in person - our founder Nils Adermann will be at the event to answer your questions and discuss the future of software supply chain security! Tickets are on sale now and the call for papers is still open too: https://lnkd.in/dkbNfTF #meetmagento #magento #meetmagentode #adobecommerce

📌 Stable versions on Packagist are now immutable. Once a version is published, the git commit it points to can no longer change. Until now, deleting and re-creating a tag silently rewrote the published version. Maintainers do this to fix a release minutes after tagging it, assuming nobody has installed it yet. In reality, mirrors, security scanners, and automated dependency updates pull new versions within seconds, and after a retag two variants of the same version number are in circulation with no way to tell them apart. The same mechanism lets an attacker with push access move a trusted, widely installed tag onto malicious code. What changes: • Retags of stable versions are blocked, the published version keeps its original commit reference • Maintainers see a warning on the package page and are notified by email • Deleted versions are no longer erased without a trace, they are marked with a reason and can be recovered if unmodified • All events are recorded on the public transparency log for the package If a release goes out wrong: version numbers are infinite, publish the fix as the next version, e.g. 1.2.3 can be republished as 1.2.3.1. Link in the comments. #php #phpc #composerphp

If you're curious about what our Ecosystem Security Team has been up to the past month, you're in luck! Volker Dusch has provided an update in our recent blog post. Read more below: #php #phpc #phpsecurity

Listen to and watch Josh Bressers interview our Co-Founder and Composer lead maintainer Jordi Boggiano on his Open Source Security Podcast for insight into our recent supply chain security push! #supplychainsecurity #php #composerphp