Shutting down Packagist.org support for Composer 1.x

Composer 1.x has served the PHP community well, but with Composer 2.0 released four years ago in October 2020, it's time to move forward. As of today, more than 95% of Composer updates are using v2, benefiting from its significant improvements in performance, memory usage, and security.

Composer 1.x suffers from architectural problems making it hard to manage a package repository with now 400,000 packages and over 4.5 million versions. So we deprecated Composer 1.x support in February 2021 and introduced delays to metadata updates and restricted access to new packages. To focus our efforts on supporting and enhancing Composer 2.x, we are now announcing the complete shutdown of Composer 1.x metadata access on Packagist.org.

Key Dates:

• February 1st, 2025: Composer 1.x metadata will become read-only. No new packages or new versions will be visible for Composer 1.x users after this date.
• August 1st, 2025: Composer 1.x metadata access will be entirely shut down. Attempting to update packages using Composer 1.x will no longer work.

Why are we making this change?

Maintaining Composer 1.x support is increasingly challenging due to its architecture and the large volume of packages and versions. By retiring 1.x, we can save significant resource and allocate more time to improving Composer 2.x, which has already become the standard for PHP package management.

What you need to do

Upgrade to Composer 2.x before the February 1st, 2025, the read-only deadline. The upgrade is simple—most projects will work with 2.x without any issues. You can review the instructions on our original 2.0 blog post and notes on BC breaks there: https://blog.packagist.com/composer-2-0-is-now-available/#2-how-easy-is-it-to-upgrade

To upgrade, use this command:

composer self-update --2

Even after 1.x metadata access is shut down, you can still run composer install with existing lock files. These lock files contain all the necessary download information and don't require metadata from Packagist.org unless you attempt to update dependencies.

Need to stick with Composer 1.x for now?

If you absolutely need to continue using Composer 1.x beyond August 2025, consider using a paid Private Packagist organization. Private Packagist will remain compatible with Composer 1.x at least until December 31st 2026. We are able to support Composer 1.x on Private Packagist more easily because each individual organization's Composer repository contains a much smaller set of packages and versions there.

For extended support beyond 2026, please contact Private Packagist customer support at contact@packagist.com.