https://bsky.app/profile/packagist.comhttps://bsky.app/profile/packagist.com/post/3mu5cdkgutw2hNew in Private Packagist, August '26 update: Organization-wide supply chain security controls, MFA enforcement for CLI access, GitLab subgroup sync, artifact packages for suborgs via API, and more complete audit logging. https://blog.packagist.com/whats-new-in-private-packagist-august-2026-update/ #php #phpc #composerphp28 Aug 2026 11:51 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mu5cdkgutw2hhttps://bsky.app/profile/packagist.com/post/3mrufkuofud24Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia help fund our shared infrastructure. https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/ #php #phpc #composerphp30 Jul 2026 12:05 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mrufkuofud24https://bsky.app/profile/packagist.com/post/3mrpem6tm3i2dWe're excited to announce @upsun.com is now sponsoring #composerphp & Packagist maintenance, ops and development! They have a long history in the #PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem.28 Jul 2026 12:04 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mrpem6tm3i2dhttps://bsky.app/profile/packagist.com/post/3mrcxvhvan42dCI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with 🌈zizmor and wrote down how to do the same on yours. https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/ #php #phpc #composerphp #github #githubactions #zizmor23 Jul 2026 13:45 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mrcxvhvan42dhttps://bsky.app/profile/packagist.com/post/3mqmcflfte624We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman.de to talk software supply chain security and answer your questions. Tickets available, CFP open: de.meet-magento.com/ #meetmagento #magento #meetmagentode #adobecommerce https://de.meet-magento.com/14 Jul 2026 13:21 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mqmcflfte624https://bsky.app/profile/packagist.com/post/3mq2r43aq4n22📌 Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, and deleted versions are tracked with a reason and recoverable. https://blog.packagist.com/immutable-versions-on-packagist/ #php #phpc #composerphp07 Jul 2026 13:57 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mq2r43aq4n22https://bsky.app/profile/packagist.com/post/3mo3leilsjc24🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins. https://blog.packagist.com/restricting-composer-plugins-across-your-organization/ #php #phpc #composerphp12 Jun 2026 10:56 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mo3leilsjc24https://bsky.app/profile/packagist.com/post/3mnhmd3vrd226The Composer CLI is part of your supply chain. Older versions miss the protections from 2.10 and have known CVEs of their own. Private Packagist customers can now enforce which Composer versions are allowed to use their repository. https://blog.packagist.com/enforce-a-safe-composer-version-across-your-organization/ #php #phpc #composerphp04 Jun 2026 12:20 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mnhmd3vrd226https://bsky.app/profile/packagist.com/post/3mncvphwlz22z⛔ Composer policies block flagged malware, but only on 2.10. A project disabling the policy, or a CI image running an old Composer, still installs flagged versions. Private Packagist now blocks these at the repository, for all versions. https://blog.packagist.com/blocking-malware-downloads-for-every-composer-version-in-private-packagist/ #php #phpc #composerphp02 Jun 2026 15:25 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mncvphwlz22zhttps://bsky.app/profile/packagist.com/post/3mn7lhv3pfk2f🛡️ Composer's download fallback behavior can silently override security decisions at the repository side, falling back from a blocked Private Packagist URL to GitHub or a source clone. Two new Private Packagist options close it off. https://blog.packagist.com/closing-composers-download-fallback-paths-in-private-packagist/ #php #phpc #composerphp01 Jun 2026 07:44 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mn7lhv3pfk2fhttps://bsky.app/profile/packagist.com/post/3mmtsjt6ha22w🔒 An update on Composer & Packagist supply chain security: where we stand, what ships this week with Composer 2.10, what's next. If you maintain PHP packages, enable MFA now. https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/ #php #phpc #composerphp #supplychainsecurity27 May 2026 15:18 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mmtsjt6ha22whttps://bsky.app/profile/packagist.com/post/3mmbr3gti2s22If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc [contains quote post or other embedded content]20 May 2026 11:04 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mmbr3gti2s22https://bsky.app/profile/packagist.com/post/3mm4vgdhqls2yThree-month Private Packagist recap: malware filter list support is already in place, ahead of Composer 2.10's release next week. Plus a new permissions tab, better job visibility, and narrower GitLab OAuth scopes. https://blog.packagist.com/whats-new-in-private-packagist-may-2026-update/ #php #phpc #composerphp18 May 2026 12:38 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mm4vgdhqls2yhttps://bsky.app/profile/packagist.com/post/3mlvhkkhi5k2uWe hope you enjoyed @glaubinix.bsky.social talk on the malware filtering features in Composer 2.10 at phpday. Try them out on latest snapshots today. Appreciate early feedback! Proud to sponsor phpday in Verona, Italy! Slides at https://glaubinix.github.io/talks/2026-05-15-Composer-2-10-Malware-Filtering.html #php #phpc #phpday #composerphp15 May 2026 13:42 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mlvhkkhi5k2uhttps://bsky.app/profile/packagist.com/post/3mlq4qj6toc2b🚨 Security advisory: Composer 2.9.8 and 2.2.28 fix a vulnerability leaking GitHub Actions GITHUB_TOKENs to job logs via error messages. Update now or disable affected workflows. https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/ #composerphp #phpc #php13 May 2026 10:45 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mlq4qj6toc2bhttps://bsky.app/profile/packagist.com/post/3mjh4zxgvfk2v🚨 Composer 2.9.6 and 2.2.27 are out with fixes for CVE-2026-40261 and CVE-2026-40176, command injection issues in the Perforce driver. Run composer self-update now. No exploits detected on Packagist.org and Private Packagist. Details: https://blog.packagist.com/composer-2-9-6-perforce-driver-command-injection-vulnerabilities/ #php #phpc #composerphp https://Packagist.org14 Apr 2026 10:06 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3mjh4zxgvfk2vhttps://bsky.app/profile/packagist.com/post/3miitkhpb4s2aSearch on Packagist is currently unavailable due to large amounts of bot traffic that @algolia.bsky.social did not filter out. They now blocked packagist. UI search and the search API are affected. We are looking into temp workarounds till Algolia resolves our support request from yesterday.02 Apr 2026 08:56 +0000at://did:plc:mw4367k4mtpplhukvwn2ppd6/app.bsky.feed.post/3miitkhpb4s2a