Private Packagist

Auditing dependencies for known security vulnerabilities Staying on top of disclosed security vulnerabilities in dependencies is a constant challenge. There are many monitoring solutions created to help track the security status of your dependencies. We offer our own Private Packagist Security Monitoring [https://blog.packagist.com/security-monitoring/] to notify customers

Modernizing Composer internals As announced in the 2.2 release notes [https://blog.packagist.com/composer-2-2/] , Composer 2.3 increases the required PHP version to >=7.2.5 and thus stops supporting PHP 5.3.2 - 7.2.4. The 2.2 LTS is still there for users stuck

LTS / Long Term Support The 2.2 minor release is an LTS (Long Term Support) release. We will provide bugfixes for critical bugs and security issues until at least the end of 2023, and will then reassess based on remaining usage. The reason we are doing this is that after

Back in 2014 (a long time ago! PHP 5.6 was just released) I figured I actually had access to some interesting information on PHP usage in the Packagist.org logs. I wrote some shell commands to extract it and wrote the first blog post of the series [https://seld.

See 2014 [https://seld.be/notes/my-view-of-php-version-adoption], 2015 [https://seld.be/notes/php-versions-stats-2015-edition], 2016.1 [https://seld.be/notes/php-versions-stats-2016-1-edition], 2016.2 [https://seld.be/notes/php-versions-stats-2016-2-edition], 2017.1 [https://seld.be/notes/php-versions-stats-2017-1-edition], 2017.2 [https://seld.be/notes/php-versions-stats-2017-2-edition], 2018.1 [https://seld.be/notes/php-versions-stats-2018-1-edition], 2018.2

On March 9th, the Git project published new releases [https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/] for maintained branches to address security vulnerability CVE-2021-21300 [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21300]. We recommend you update your Git installation to a release containing the fix.

Last week a lot of people decided to change their default branch name away from master to use more inclusive language in technology (read Scott Hanselman [https://www.hanselman.com/blog/EasilyRenameYourGitDefaultBranchFromMasterToMain.aspx] explain why and how). As we fielded questions from Composer package authors wondering what the impact would

You can now update Composer to 1.10 with the composer.phar self-update command. The full changelog for 1.10 is available on GitHub [https://github.com/composer/composer/releases/tag/1.10.0] as usual, listing all the small new features and bugfixes in this release. Composer 1.10

Today we're happy to present a new feature on Private Packagist [https://packagist.com/?utm_source=blog&utm_medium=link&utm_content=agencies]: per-project Composer repositories with simplified permissions for agencies and other companies who manage multiple independent Composer projects which cannot share all packages. We originally built Private Packagist