Packagist.org shutdown of Composer 1.x support postponed to September 1st, 2025

With the deadline drawing near, we’d like to remind you that we are discontinuing Composer 1.x support on Packagist.org soon. We're extending our original timeline by one month to give teams additional preparation time to migrate. Composer 1.x metadata access will now shut down on September 1st, 2025 instead of August 1st.

Composer 1.x suffers from architectural problems that make it hard to manage the increasing number of packages and versions on Packagist.org. Composer 2.x solves these problems, along with huge improvements to performance, memory usage, and security. 

Upgrade to Composer 2

We strongly encourage everyone to upgrade to Composer 2.x, which has become the standard for PHP package management since its release in 2020. The migration is straightforward for most projects. Simply issue the following command to upgrade:

composer self-update --2

You can review the upgrade instructions and notes on BC breaks in more detail in the original Composer 2 announcement. 

Need More Time? 

If upgrading to Composer 2 really isn't an option for you right now, consider using a paid Private Packagist organization. Private Packagist will continue to support Composer 1.x, giving you the time you need to plan your migration properly.

Private Packagist is more easily able to continue to support Composer 1.x because it doesn’t have to take all of the hundreds of thousands of packages on Packagist.org into account, but only the packages used within your organization. It can use the Composer 2 protocol itself to communicate with Packagist.org, but still offer the Composer 1.x protocol to users of Private Packagist.

Private Packagist now guarantees Composer 1.x support until at least September 1st, 2027, two full years beyond the public shutdown. Depending on commercial interest, we may consider extending support even further, beyond 2027. 

Private Packagist mirrors your Packagist.org dependencies into your private Composer repository on packagist.com, which replaces Packagist.org in your composer.json. That’s all you need to continue using Composer 1.x as usual. You can find more details on the Extended Composer 1.x support page.

Don't let the deprecation deadline catch you unprepared! Either upgrade to Composer 2 or migrate to Private Packagist for extended 1.x support, so your PHP projects can continue to receive updates. So, act now.