Co-Founder of @packagist / #ComposerPHP – Head of Engineering at @TeamupCalendar @seld.be on bsky
Zürich, Switzerland
Joined July 2008
- Tweets16K
- Following815
- Followers19.4K
- Likes332
Jordi Boggiano retweeted
Packagist turns 15 years old and has served more than 200 billion package installs 🎉
A look back at how Composer and Packagist started, 15 years of milestones, 2026 AI growth and what comes next.
blog.packagist.com/15-years-…
#php #phpc #composerphp
Jordi Boggiano retweeted
New in Private Packagist, August '26 update: Organization-wide supply chain security controls, MFA enforcement for CLI access, GitLab subgroup sync, artifact packages for suborgs via API, and more complete audit logging.
blog.packagist.com/whats-new…
#php #phpc #composerphp
Jordi Boggiano retweeted
Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors 🤝 @AikidoSecurity, @awscloud, @SocketSecurity, @BunnyCDN, @upsundotcom, @sonatype, @tideways, @datadog and @algolia for sharing this burden.
blog.packagist.com/announcin…
#php #phpc #composerphp
Most package metadata updates are failing on @packagist currently due to GitHub API issues. See githubstatus.com/
Jordi Boggiano retweeted
📌 Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, deletions are tracked with a reason and recoverable, and everything is recorded on the public transparency log.
#php #phpc #composerphp
ALT Packagist: immutable Versions, featuring a shield and a tag labeled v1.2.3 with an arrow to a follow up commit indicated with a dot. The arrow is crossed out and blocked.
Jordi Boggiano retweeted
Busy times: Here are my slides on Composer & Packagist Supply Chain Security from #PHPVerse: naderman.de/slippy/slides/20…
Thanks @jetbrains for a great online event! Videos soon! Follow blog.packagist.com for updates.
#php #phpc #composerphp #supplychainsecurity
Jordi Boggiano retweeted
🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins. #php #phpc #composerphp
🤖 Made with AI
ALT Private Packagist: Restricting Composer plugins across your organization Shield icon behind a jigsaw puzzle piece representing a plugin, connecting to multiple puzzle pieces with checkmarks or crosses underneath a building and a group of 3 people
Jordi Boggiano retweeted
The Composer CLI is part of your supply chain. Older versions miss the protections in 2.10 and carry known CVEs of their own.
Private Packagist customers can now enforce which Composer client versions can talk to their repository.
#php #phpc #composerphp
ALT Private Packagist: Enforce a Safe Composer Version Across Your Organization 3 groups of people connecting to a package with the composer logo and a checkmark in front of a shield icon
Ever found yourself accidentally merging changes to the public API of a PHP package and regretting it later? I made a GitHub Action to help prevent that. seld.be/notes/surfacing-publ…
Jordi Boggiano retweeted
⛔ Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp
Jordi Boggiano retweeted
🛡️ Composer's download fallbacks can silently undermine repository security: A Private Packagist URL blocked for a malware-flagged version falls back to GitHub or a source clone.
Two new Private Packagist options close it off.
#php #phpc #composerphp
I realized I was never going to get to adding zizmor to all my repos so I made a claude skill to let it do the grunt work.
You can use it too, if it helps more busy/lazy people to secure their GitHub repos I am glad!
See github.com/Seldaek/zizmorify
We recommend you change the default permissions for GitHub Actions GITHUB_TOKENs to read-only. Grant elevated permissions only where necessary. Use zizmor to analyze your GitHub Actions: github.com/zizmorcore/zizmor see also: phpunit.expert/articles/hard…
ALT Workflow permissions setting screen in GitHub with "Read repository contents and packages permissions" selected rather than "Read and write permissions"
Composer 2.10 is out.
Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.
#php #phpc #composerphp
ALT Composer fending off packages, Malware automatically blocked
Full Composer 2.10 release announcement at: blog.packagist.com/composer-…
Jordi Boggiano retweeted
We recommend you change the default permissions for GitHub Actions GITHUB_TOKENs to read-only. Grant elevated permissions only where necessary. Use zizmor to analyze your GitHub Actions: github.com/zizmorcore/zizmor see also: phpunit.expert/articles/hard…
ALT Workflow permissions setting screen in GitHub with "Read repository contents and packages permissions" selected rather than "Read and write permissions"
It took us a bit longer than expected but after over a month of discussions and rewrites, Composer 2.10 RC2 is now available for testing with a new policy config and detected malware now blocked by default on install. github.com/composer/composer… #composerphp #phpc
Jordi Boggiano retweeted
If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php
Jordi Boggiano retweeted
Three months of Private Packagist updates: Malware filter list support already in place, ahead of Composer 2.10's release next week. Plus a new package permissions tab, better background job visibility, and a narrower GitLab OAuth scope. Link 👇
#php #phpc #composerphp
Jordi Boggiano retweeted
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php