changelog What's new in Private Packagist, August 2026 update We've shipped a large batch of updates to Private Packagist over the past few months. A lot of our attention went to supply chain security, which we've covered in depth in our supply chain security series. In this post, we'll highlight the other improvements
supplychain Blocking malware downloads for every Composer version in Private Packagist This is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release, and the recent post on closing Composer's download fallback paths. Composer 2.10's dependency policy framework is a substantial step forward for PHP supply
composer Composer 2.10 Release We are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of security advisories, abandoned packages, and now malware. Fast detection of malware for packages published on Packagist.org is provided by Aikido.
composer An update on Composer & Packagist supply chain security The last months, and even more so the last weeks, saw an increasing amount of software supply chain attacks targeting open-source ecosystems. A handful of these have hit the PHP ecosystem too, via taken-over GitHub accounts and stolen access tokens that let attackers publish new tags on packages
changelog What's new in Private Packagist, May 2026 Update Over the past three months, we've shipped updates focused on security, integrations with code hosting platforms, and usability improvements throughout Private Packagist. Here's a rundown of the most notable changes. Support for malware filter lists We've added support for malware filter lists to help
