Deprecating Packagist.org support for Composer 1.x
As you are hopefully aware by now, Composer 2.0 was released in late October 2020. We hinted in the release announcement that Composer 1.x was pretty much EOL and today I want to expand a bit on the timeline we have in mind for the Packagist.org support for Composer 1.x.
First of all we realized in the past few months that 1.x will probably take years to fully go away. Composer is installed in too many places, and so we will have to keep supporting the v1 metadata format for a long time to prevent disrupting workflows.
The biggest hurdle we have however is that the v1 metadata is taking a lot of packagist.org resources to be dumped to static JSON files due to the format it uses. Therefore we have come up with two steps to reduce the negative impact on our infrastructure:
Reduced v1 metadata API update rate starting in May 2021
The update rate for new versions will be reduced from every-minute currently to once every 15 minutes. This means new releases will take a few minutes longer to be available for installation with Composer 1.x.
On the upside, the changes we have to make to implement this slower rate for v1 mean that we can speed up the v2 metadata updates to happen within a few seconds instead of being bundled with the once-a-minute v1 updates.
Restricted access to unused packages via the v1 metadata API starting in May 2021
The other problem we face is that we are currently dealing with 300,000 packages with a combined 2,700,000 versions which have to be kept in sync, and the v1 format uses very long file lists which mean that the number of packages has a major impact on the process's performance.
To resolve this, we will hide (on a rolling basis) all packages which had no downloads in the last 4 months from the v1 index. This will cut the amount of packages by about half without having a large impact on active usage.
This means new packages and old unused packages will only be visible to Composer 2 until someone installs them, at which point they will become visible to Composer 1 as well (within 24h as this process happens on a nightly basis).
API users: Please get in touch now!
If you are using the v1 metadata as an API and not via Composer, please review the current API docs (now including v2 format) at https://packagist.org/apidoc. Check if you can upgrade to this new format. If you cannot, get in touch with us now before we make the changes above so we can hopefully get you the tools you need.
Not using Composer 2 yet? Upgrade now!
You can use composer self-update --2 to migrate to it. Should you encounter issues, you can go back at any time by using composer self-update --1. Read the Composer 2 announcement for more.
You can also find specific instructions for various frameworks/CMSs/apps on GitHub which may assist you in upgrading.