The packagist team announced it's shutting down support for Composer v1.x on February 25th, 2025.
Composer 1.x has served the PHP community well, but with Composer 2.0 released four years ago in October 2020, it's time to move forward. As of today, more than 95% of Composer updates are using v2, benefiting from its significant improvements in performance, memory usage, and security.
Composer 1.x suffers from architectural problems making it hard to manage a package repository with now 400,000 packages and over 4.5 million versions. So we deprecated Composer 1.x support in February 2021 and introduced delays to metadata updates and restricted access to new packages. To focus our efforts on supporting and enhancing Composer 2.x, we are now announcing the complete shutdown of Composer 1.x metadata access on Packagist.org.
The key dates moving forward are:
- February 1st, 2025: Composer 1.x metadata will become read-only. No new packages or new versions will be visible for Composer 1.x users after this date.
- August 1st, 2025: Composer 1.x metadata access will be entirely shut down. Attempting to update packages using Composer 1.x will no longer work.
As mentioned in their announcement, 96% of Composer updates use v2, so there is a good chance you will not be affected by this. However, if you have legacy apps, checking and ensuring they are on v2 would be good. If not, then update them before the key dates.
Eric is the creator of Laravel News and has been covering Laravel since 2012.
