📦 Composer 2.10 is out. Native malware filtering via @aikidosecurity.bsky.social (enabled by default on Packagist), a unified config.policy framework for advisories/abandoned/malware, and source fallback now deprecated. blog.packagist.com/composer-2-1... #php #phpc #composerphp

🔒 An update on Composer & Packagist supply chain security: where we stand, what ships this week with Composer 2.10, what's next. If you maintain PHP packages, enable MFA now. blog.packagist.com/an-update-on... #php #phpc #composerphp #supplychainsecurity

It took us a bit longer than expected but after over a month of discussions and rewrites, Composer 2.10 RC2 is now available for testing with a new policy config and detected malware now blocked by default on install. github.com/composer/com... #composerphp #phpc

If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc

Announcing the Ecosystem Security Team at The PHP Foundation! Thanks to a grant from Alpha-Omega at @linuxfoundation.org, this effort will improve security across the entire PHP ecosystem. The amazing @edorian.bsky.social will be filling this role.✨ thephp.foundation/blog/2026/05... #php #security

Three-month Private Packagist recap: malware filter list support is already in place, ahead of Composer 2.10's release next week. Plus a new permissions tab, better job visibility, and narrower GitLab OAuth scopes. blog.packagist.com/whats-new-in... #php #phpc #composerphp

We hope you enjoyed @glaubinix.bsky.social talk on the malware filtering features in Composer 2.10 at phpday. Try them out on latest snapshots today. Appreciate early feedback! Proud to sponsor phpday in Verona, Italy! Slides at glaubinix.github.io/talks/2026-0... #php #phpc #phpday #composerphp

🚨 Security advisory: Composer 2.9.8 and 2.2.28 fix a vulnerability leaking GitHub Actions GITHUB_TOKENs to job logs via error messages. Update now or disable affected workflows. blog.packagist.com/composer-2-9... #composerphp #phpc #php

🚨 Composer 2.9.6 and 2.2.27 are out with fixes for CVE-2026-40261 and CVE-2026-40176, command injection issues in the Perforce driver. Run composer self-update now. No exploits detected on Packagist.org and Private Packagist. Details: blog.packagist.com/composer-2-9... #php #phpc #composerphp

Search on Packagist is currently unavailable due to large amounts of bot traffic that @algolia.bsky.social did not filter out. They now blocked packagist. UI search and the search API are affected. We are looking into temp workarounds till Algolia resolves our support request from yesterday.

We need your help to test Composer 2.10. Expect a final release next week, now is the time to try it out and flag any issue you find! github.com/composer/com... #composerphp #phpc

Whoop! PHP London is meeting again next week: https://meetu.ps/e/PXrS6/2XF6m/i #php #london #elephpants #meetup

In Amsterdam next week and part of a group underrepresented at tech confs, or can't afford a ticket? Private Packagist is sponsoring #SymfonyCon (Nov 27th/28th) and we have a ticket to give away: Reply your favorite PHP8.5 feature to win #php #phpc #symfony @symfony.com

Composer 2.9 is here! 🚀 It automatically blocks packages with known vulnerabilities, has a new repository command to manage repos from the CLI, and lots more! blog.packagist.com/composer-2-9/ #composerphp #phpc #PHP

Composer 2.9 is coming, and there's an RC to try out! We need your help and feedback github.com/composer/com... #composerphp #phpc

🚨 Warning to #PHP package maintainers: We did not email you to change your passwords & 2FA. Emails asking you to update your credentials are a phishing attempt. We had the phishing site & domain taken down. If you got the email and entered your credentials, please contact us. #phpc

🚨 PSA for #PHP package maintainers: DO NOT REPLACE tags! If you messed up a release simply do another. No matter how quickly you notice a mistake, automatic tools already pulled the original tag, triggered automatic updates. Users will never know you recreated the tag and use the broken state. #phpc

Would you like to attend #APIPlatformCon 2025 in Lille on Sep 18/19 or online? Private Packagist is sponsoring: 4 tickets to give away! Part of a group underrepresented at tech conferences, or can't afford a ticket? Repost and reply favorite PHP package(s) #php #composerphp #phpc

The Online Safety Act is terrible for privacy. This is not just about pornography, it has wide over-reach into all our digital lives. It is authoritarian, and literally embodies parts of an Orwellian 1984 - except this is reality, not just a dystopian novel. petition.parliament.uk/petitions/72...

🚨 Packagist.org shutdown of Composer 1.x support postponed to September 1st, 2025. Act now, upgrade to Composer 2! Last resort: check out Private Packagist extended 1.x support if you really cannot migrate right now. blog.packagist.com/packagist-or...

Hey folks 👋 , I'm available to hire! 💼 Part time, ~4h/day ⏳ Happy to work remote EU/UK/US ✅ I am a software team leader, Java/PHP/Rust/C/etc 🧑‍💼 Experience in avionics/finance/insurance/education/gov If you would like to talk more and see how I can help your team succeed, DM me and lets chat! 💬

May update: Progress on Conductor, expiring API credentials, stronger account protection, improved user profile/settings UX & performance boosts! Details: blog.packagist.com/whats-new-in... #php #composer #composerphp #phpc

Alright, I’ve decided I’m leaving my job. Officially looking for work! Me: software engineer, >10 years industry experience. Backend heavy but exp across the stack from infra to FE. Experience leading teams. PHP, Rust, Go, TS, good at learning new stacks/langs! Shares super appreciated ❤️

Stop by our @packagist.com booth at #LaraconEU and have a chat about Composer, Packagist, Conductor or anything else relating to dependency management and supply chain security! #Laravel #Laracon

I have been playing around with running PHP through WASM, mostly to see how we can enable more extensions for the one that runs in the PHP documentation. Following up from our latest @thephpf developers meeting, where we discussed improving the @php website, I […] [Original post on phpc.social]

We're excited to introduce you to 🧑‍✈️Conductor! Automatic dependency update PRs with Composer for PHP projects - Security fixes patched in minutes - Continuous updates without the hassle - all running in your own CI env! Early access waitlist: packagist.com/features/con... #composerphp #php #phpc