Announcing the Composer & Packagist Sponsorship Program

Today we are launching a formal sponsorship program for Composer and Packagist.org, together with new public sponsor pages on packagist.org/sponsor and getcomposer.org/sponsor.

We want to start by thanking the companies who are on board at launch: Private Packagist, Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog, and Algolia, as well as the Sovereign Tech Agency, which funds two improvement projects through the PHP Foundation.

Why now

Composer and Packagist.org are critical shared infrastructure for the entire PHP ecosystem. Millions of developers rely on them, and Packagist.org serves billions of package installs every year. For most of their history, this infrastructure has been funded by a single company: Private Packagist, our commercial dependency management product, covers more than half of the current expenses, complemented by generous infrastructure donations from providers we have worked with for years.

That model has kept the lights on, but it does not scale with what the ecosystem now demands of us. Last year, Packagist joined more than a dozen package registries, including npm, PyPI, Maven Central, crates.io, and RubyGems, in signing the OpenSSF open letter Open Infrastructure Is Not Free, followed this May by Part II: The Hidden Cost of Running Package Registries. The message of both letters is simple: package registries have become foundational infrastructure for the world's software supply chains, and the pressures on them keep growing. Usage keeps rising, supply chain attacks have increased in both frequency and sophistication, regulatory and compliance requirements around software supply chains are expanding, and AI accelerates both legitimate consumption and attacks. The companies that benefit commercially from this infrastructure need to participate in sustaining it.

This sponsorship program is our first concrete step to act on those letters for the PHP ecosystem. It stabilizes the financing of Composer and Packagist.org and spreads it across more of the enterprises that rely on and profit from a functioning PHP ecosystem.

Why financial support, not just infrastructure credits

We are deeply grateful for the infrastructure donations we receive, covering bandwidth, CDN, hosting, monitoring, and search, and they remain an important part of the picture. But donated infrastructure cannot cover our largest cost: people. Most of our expenses are staff, doing work that is largely invisible when it goes well:

• 24/7 operations. Packagist.org needs to be up when your CI runs, whatever time zone you deploy from.
• Support. Helping publishers who lost access to their MFA devices, mediating disputes between companies over trademarks and package names, and answering everything in between.
• Emergency response. Reacting to supply chain attacks within minutes of detection, including in the middle of the night, and pulling malicious releases before they can be installed at scale.
• Maintenance. Keeping up with a constantly shifting environment: Reacting to vulnerability reports, working on bug reports, reviewing feature proposals, but also what nobody cares about but expects to work: GitHub token format changes, API changes across VCS platforms, Bitbucket app password deprecations.
• Development. Everything covered in our recent supply chain security update, such as malware detection, the transparency log, immutable versions, and dependency policies, as well as the longer roadmap toward mandatory MFA, staged releases, and build provenance, is engineering time. To implement everything we are hoping to accomplish, we need to fund more of it.

Private Packagist does its part, and every Private Packagist subscription directly funds this work. But expecting every company that depends on Packagist.org to become a Private Packagist customer is not realistic, and one product cannot carry an entire ecosystem alone.

What sponsorship looks like

The program launches with three tiers: Bronze at €2,500/month, Silver at €5,000/month, and Gold at €8,000/month, each based on an annual commitment. All tiers include logo placement on the getcomposer.org and packagist.org sponsor pages and the Composer GitHub README, and a social media welcome post. Silver adds a shared Slack channel connecting your engineers directly with the Composer maintainers and the engineers operating Packagist.org, as well as priority issue response on GitHub. Gold additionally places your logo in the Packagist.org footer. The full details are on the sponsor page, and you can reach us at sponsoring@packagist.org.

If the sponsorship tiers are not the right fit for your smaller company, a Private Packagist subscription (from €59/month) is the best way to support us, and you get package mirroring, security monitoring, update review, and private package hosting in return. Individual developers who want to contribute can do so through GitHub Sponsors, but we’re really calling on corporations to fund this service, not individuals.

Where this is heading

We want to be transparent about the direction: sponsorships with a marketing focus are a first measure, not the end state.

The long-term goal is to transition toward clear infrastructure and engineering subscriptions, so that every major beneficiary of Composer and Packagist.org participates equitably in funding them, the way companies already budget for any other critical infrastructure they depend on. We are working out the details of that model together with other registries in the Linux Foundation's Sustaining Package Registries Working Group, and we will share more as it takes shape.

To make this concrete, here are a few non-exhaustive examples of businesses we believe should contribute a fair amount toward the Packagist.org service they build on:

• SaaS vendors distributing SDKs. Large enterprises publish client SDKs for their commercial SaaS services as packages on Packagist.org. These SDKs are open source in name only; they are useless without the paid service behind them. These companies use Packagist.org as a free distribution channel for a component of their commercial product. (Thanks for stepping up in this category already: AWS, Datadog, Tideways, Algolia, and Upsun) 
• Private package repositories. We appreciate the positive impact mirroring repositories has on resource use. But caching only reduces bandwidth. Staff costs for operations, support, incident response, and development cannot be cached. Businesses generating significant profit on top of our service need to participate in carrying these costs. (Thanks for stepping up in this category already: Sonatype)
• Bulk data consumers. Businesses making significant profit from the data we provide, for example in security analysis, search, or recommendation products, as well as AI companies collecting packages and metadata as training material for their models. (Thanks for stepping up in this category already: Aikido and Socket)

We call on all of these groups to become sponsors today and to start a dialog with us. Together we can find a fair and suitable way to turn these uses into ongoing contractual relationships: relationships that sustain the PHP ecosystem they benefit from, and that provide them with the right access and support they need in return.

Working out those details, and building whatever the resulting model requires, takes time and money in itself. So in the meantime, we are asking companies to come forward and help fund our work through this sponsorship program.

One thing will not change: Packagist.org stays free for individual developers and small and medium companies. Our goal is and will remain to provide open access to open source packages. What we are asking is that the companies building products worth hundreds of millions or billions on top of this infrastructure pay their reasonable fair share to keep it running: reliable, secure, and independent, for every PHP developer.

If that describes your company, get in touch. And to our launch sponsors: thank you for leading the way.