#phpc — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #phpc, aggregated by home.social.
-
Curious about the PHP Ambassador Program we started a few weeks ago? We posted a progress update on our blog today. Exciting things are happening and you can be a part of the movement! Read more: https://thephp.foundation/blog/2026/08/13/php-ambassadors-six-weeks-in/
#php #phpc #phpambassadors -
Curious about the PHP Ambassador Program we started a few weeks ago? We posted a progress update on our blog today. Exciting things are happening and you can be a part of the movement! Read more: https://thephp.foundation/blog/2026/08/13/php-ambassadors-six-weeks-in/
#php #phpc #phpambassadors -
Our next #phpugmrn meetup is happening on August 20!
We're excited to welcome @elizabeth as our guest speaker. As the Executive Director of The PHP Foundation, Liz will introduce the foundation's mission, highlight its impact on the PHP ecosystem, and share insights into its upcoming plans.
Intrested to know more about The PHP Foundation? Sign up here https://www.meetup.com/phpug-rhein-neckar/events/312782230/
-
Our next #phpugmrn meetup is happening on August 20!
We're excited to welcome @elizabeth as our guest speaker. As the Executive Director of The PHP Foundation, Liz will introduce the foundation's mission, highlight its impact on the PHP ecosystem, and share insights into its upcoming plans.
Intrested to know more about The PHP Foundation? Sign up here https://www.meetup.com/phpug-rhein-neckar/events/312782230/
-
Thanks to Brian Fox and Sonatype: a key role in the Sustaining Package Registries Working Group as steward of Maven Central, and now sponsoring Composer & Packagist even though one of their products competes with our own Private Packagist. The infrastructure underneath both our products is shared, and we need to fund it together.
That is where this needs to be heading: every major beneficiary contributing, like any other critical infrastructure they budget for.
-
Thanks to Brian Fox and Sonatype: a key role in the Sustaining Package Registries Working Group as steward of Maven Central, and now sponsoring Composer & Packagist even though one of their products competes with our own Private Packagist. The infrastructure underneath both our products is shared, and we need to fund it together.
That is where this needs to be heading: every major beneficiary contributing, like any other critical infrastructure they budget for.
-
Composer & Packagist now have a formal sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia.
Our costs are primarily staff: operations, support, emergency response, maintenance and development. We ask enterprises profiting from the PHP ecosystem to pay their fair share to keep our shared critical infrastructure available to all PHP developers.
https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/
-
Composer & Packagist now have a formal sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia.
Our costs are primarily staff: operations, support, emergency response, maintenance and development. We ask enterprises profiting from the PHP ecosystem to pay their fair share to keep our shared critical infrastructure available to all PHP developers.
https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/
-
We're excited to announce @upsun is now sponsoring Composer & Packagist maintenance, operations and development! Upsun is a great platform to run PHP applications and they have a long history in the PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem.
If your company wants to still become a launch partner for our sponsorship program this week, reach out to [email protected].
-
We're excited to announce @upsun is now sponsoring Composer & Packagist maintenance, operations and development! Upsun is a great platform to run PHP applications and they have a long history in the PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem.
If your company wants to still become a launch partner for our sponsorship program this week, reach out to [email protected].
-
CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈
Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/#php #phpc #composerphp #github #githubactions #supplychainsecurity
-
CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈
Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/#php #phpc #composerphp #github #githubactions #supplychainsecurity
-
In an effort to further prioritize the handling of security reports for the PHP language, we are thrilled to add Alex Daubois as a part-time addition to our team of contractors. Alex brings a *wealth* of experience to the team and we are grateful for his contributions. Welcome, Alex! Read more: https://thephp.foundation/blog/2026/07/14/welcoming-alexandre-daubois/
-
In an effort to further prioritize the handling of security reports for the PHP language, we are thrilled to add Alex Daubois as a part-time addition to our team of contractors. Alex brings a *wealth* of experience to the team and we are grateful for his contributions. Welcome, Alex! Read more: https://thephp.foundation/blog/2026/07/14/welcoming-alexandre-daubois/
-
📌 Stable versions on Packagist are now immutable. Once a version is published, the git commit it points to can no longer change. Retags are blocked and deleted versions are now marked with a reason and recoverable, if unmodified. Every change is recorded on the package's public transparency log.
All details on our blog: https://blog.packagist.com/immutable-versions-on-packagist/
-
📌 Stable versions on Packagist are now immutable. Once a version is published, the git commit it points to can no longer change. Retags are blocked and deleted versions are now marked with a reason and recoverable, if unmodified. Every change is recorded on the package's public transparency log.
All details on our blog: https://blog.packagist.com/immutable-versions-on-packagist/
-
Does PHP really need asynchronous programming in its core, or should it continue focusing on its proven synchronous execution model?
-
Does PHP really need asynchronous programming in its core, or should it continue focusing on its proven synchronous execution model?
-
If you have opinions on what should be in PHP properties robots.txt for our various sites or if we should block or guide LLM agents, I'd like to hear about it: https://github.com/php/infrastructure/issues/40#issuecomment-4836908034
-
If you have opinions on what should be in PHP properties robots.txt for our various sites or if we should block or guide LLM agents, I'd like to hear about it: https://github.com/php/infrastructure/issues/40#issuecomment-4836908034
-
In our latest blog post, Foundation contractor @shivammathur digs into the details of providing support for PHP builds on Windows and why this is such an important piece of the work we do. 🚀 https://thephp.foundation/blog/2026/06/26/maintaining-php-build-infrastructure-for-windows-tooling-for-builds-and-security-updates/ #php #phpc #windows #security
-
In our latest blog post, Foundation contractor @shivammathur digs into the details of providing support for PHP builds on Windows and why this is such an important piece of the work we do. 🚀 https://thephp.foundation/blog/2026/06/26/maintaining-php-build-infrastructure-for-windows-tooling-for-builds-and-security-updates/ #php #phpc #windows #security
-
If you're curious about what our Ecosystem Security Team has been up to the past month, you're in luck! @edorian has provided an update in our recent blog post. https://thephp.foundation/blog/2026/06/23/one-month-of-ecosystem-security-engineering/ #php #phpc #phpsecurity
-
If you're curious about what our Ecosystem Security Team has been up to the past month, you're in luck! @edorian has provided an update in our recent blog post. https://thephp.foundation/blog/2026/06/23/one-month-of-ecosystem-security-engineering/ #php #phpc #phpsecurity
-
Attention future PHP Ambassadors! You can now join this Special Interest Group if you want to help improve the perception of PHP in tech spaces outside our bubble. Help us help the community tell the real story of modern PHP development! #php #phpc #phpambassadors Read more: https://thephp.foundation/blog/2026/06/19/the-php-ambassador-program-is-open/
-
Attention future PHP Ambassadors! You can now join this Special Interest Group if you want to help improve the perception of PHP in tech spaces outside our bubble. Help us help the community tell the real story of modern PHP development! #php #phpc #phpambassadors Read more: https://thephp.foundation/blog/2026/06/19/the-php-ambassador-program-is-open/
-
Building a more accessible PHP ecosystem is something The PHP Foundation cares a great deal about. We are honored to share this post from guest blogger @menelion about what it's like to be a visually impaired PHP developer, learning and coding PHP. 💙 #php #accessibility #phpc
https://thephp.foundation/blog/2026/06/16/php-through-a-screen-reader-small-syntax-choices-that-matter/ -
Building a more accessible PHP ecosystem is something The PHP Foundation cares a great deal about. We are honored to share this post from guest blogger @menelion about what it's like to be a visually impaired PHP developer, learning and coding PHP. 💙 #php #accessibility #phpc
https://thephp.foundation/blog/2026/06/16/php-through-a-screen-reader-small-syntax-choices-that-matter/ -
The last weeks have been busy: Here are my slides on Composer & Packagist Supply Chain Security in 2026 from #PHPVerse last week: https://naderman.de/slippy/slides/2026-06-09-PHPVerse-Composer-and-Packagist-Supply-Chain-Security-in-2026.pdf
Thank you to @jetbrains for organizing a fantastic online event with thousands of simultaneous live viewers again! Video recordings will be published soon as well!
Follow https://blog.packagist.com for updates on supply chain security.
-
The last weeks have been busy: Here are my slides on Composer & Packagist Supply Chain Security in 2026 from #PHPVerse last week: https://naderman.de/slippy/slides/2026-06-09-PHPVerse-Composer-and-Packagist-Supply-Chain-Security-in-2026.pdf
Thank you to @jetbrains for organizing a fantastic online event with thousands of simultaneous live viewers again! Video recordings will be published soon as well!
Follow https://blog.packagist.com for updates on supply chain security.
-
🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins.
https://blog.packagist.com/restricting-composer-plugins-across-your-organization/
#php #phpc #composerphp -
🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins.
https://blog.packagist.com/restricting-composer-plugins-across-your-organization/
#php #phpc #composerphp -
RE: https://phpc.social/@brendt/116719832760676261
Live now, free online conference #PHPVerse2026! Join us now!
-
RE: https://phpc.social/@brendt/116719832760676261
Live now, free online conference #PHPVerse2026! Join us now!
-
The Composer CLI is part of your supply chain. Older versions miss the protections shipped in 2.10 (dependency policies, malware feed integration, source fallback off by default) and carry known client-side CVEs.
Private Packagist customers can now enforce which Composer client versions are allowed to talk to their Composer repository, with a clear upgrade message shown in the developer's terminal when an outdated client tries to connect.
https://blog.packagist.com/enforce-a-safe-composer-version-across-your-organization/
#php #phpc #composerphp -
The Composer CLI is part of your supply chain. Older versions miss the protections shipped in 2.10 (dependency policies, malware feed integration, source fallback off by default) and carry known client-side CVEs.
Private Packagist customers can now enforce which Composer client versions are allowed to talk to their Composer repository, with a clear upgrade message shown in the developer's terminal when an outdated client tries to connect.
https://blog.packagist.com/enforce-a-safe-composer-version-across-your-organization/
#php #phpc #composerphp -
⛔ Composer dependency policies block flagged malware by default, but only on 2.10. A project disabling the policy, or a CI image running Composer 2.4, still installs flagged versions normally until we can manually pull it from Packagist.
Private Packagist now refuses to serve dist files for malware-flagged versions at the repository level, regardless of the Composer version requesting them. Enabled by default for new and existing organizations.
-
⛔ Composer dependency policies block flagged malware by default, but only on 2.10. A project disabling the policy, or a CI image running Composer 2.4, still installs flagged versions normally until we can manually pull it from Packagist.
Private Packagist now refuses to serve dist files for malware-flagged versions at the repository level, regardless of the Composer version requesting them. Enabled by default for new and existing organizations.
-
🛡️ Blog: How Composer's download fallback behavior can silently override security decisions at the repository side, and what we are doing about it.
If Private Packagist refuses to serve a malware-flagged version, Composer can fall back to the original GitHub URL, or even clone from source. Two new Private Packagist options close both fallback paths, regardless of the Composer version your developers and CI happen to be running.
https://blog.packagist.com/closing-composers-download-fallback-paths-in-private-packagist/
#php #phpc #composerphp -
🛡️ Blog: How Composer's download fallback behavior can silently override security decisions at the repository side, and what we are doing about it.
If Private Packagist refuses to serve a malware-flagged version, Composer can fall back to the original GitHub URL, or even clone from source. Two new Private Packagist options close both fallback paths, regardless of the Composer version your developers and CI happen to be running.
https://blog.packagist.com/closing-composers-download-fallback-paths-in-private-packagist/
#php #phpc #composerphp -
PHP doesn't have an image problem in 2026. It has a tutorial problem.
Too many "learn PHP" articles still teach PHP 5.6 and PHP 7.x patterns while modern PHP has evolved dramatically.
Today’s PHP means:
Strict Types
Enums
Attributes
Readonly Classes
Property Hooks
Dependency Injection
Composer
Modern TestingIf your tutorial still uses mysql_*, no namespaces, and no Composer, you're learning PHP history—not modern PHP.
The PHP ecosystem deserves more up-to-date educational content.
-
🔒 An update on Composer & Packagist supply chain security:
Covering what's in place today, what ships this week with Composer 2.10 (dependency policies, stable version immutability), what's coming next (mandatory MFA, minimum-release-age policy, organizational package ownership), and the long-term direction toward immutable artifacts with SLSA provenance and sigstore attestations.
If you maintain PHP packages, please enable MFA now.
https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
#php #phpc #composerphp -
🔒 An update on Composer & Packagist supply chain security:
Covering what's in place today, what ships this week with Composer 2.10 (dependency policies, stable version immutability), what's coming next (mandatory MFA, minimum-release-age policy, organizational package ownership), and the long-term direction toward immutable artifacts with SLSA provenance and sigstore attestations.
If you maintain PHP packages, please enable MFA now.
https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
#php #phpc #composerphp -
RE: https://phpc.social/@packagist/116566852406125489
If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc
-
RE: https://phpc.social/@packagist/116566852406125489
If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc
-
I have a question for JavaScript/Node.js developers:
Why doesn’t the JavaScript ecosystem have a framework like Ruby on Rails, Django, or Java Spring Boot — or even something close to Laravel in PHP ?
no one say: Express.js most downloaded library.
#php #phpc #laravel #ruby #java #nodejs #python #javascript #spring #springboot #rails #rubyandrails #typescript #expressjs #webdev #django