It's saturday so obviously I'm applying patches/workarounds to Packagist servers for the latest CVE, and hardening other stuff while I'm at it. I really hope the pace of all this calms down eventually
JB
Jordi Boggiano
@Seldaek
Working on https://packagist.com and 
@composer lead
- Packagist
- Zürich, Zurich, Switzerland
- seld.be/
- github.com/Seldaek
- Sponsor on GitHub
- Joined October 2026
Commit activity
42 commits in the last 30 days
longest streak 5 dayscurrent 5
1,184 / 2,500 XP1,316 XP to root
Yesterday
Thu, Oct 29
All of a sudden it seems a lot more worth it that @composer 2.11 comes with protection against stale CA bundles that still include eMudhra certs. https://x.com/QuinnyPig/status/2115853299287257221
X (formerly Twitter)Corey Quinn (@QuinnyPig) on XHoly balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/! What the hell are you doing over there, Apple friends?
@composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update.
Composer 2.11 includes several security fixes, block-scope support for custom…
Private PackagistComposer 2.11We are pleased to announce the release of Composer 2.11.0. The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions for a configurable period of time before Composer will install them. Composer 2.11 also ships several security fixes, removes the
json
"config": { "policy": { "cooldown": { "period": "1 day" } } }
Wed, Oct 28
Sun, Oct 25
Sat, Oct 24
Fri, Oct 23
Can we get rolling window rate limiting for pasteis too?
Not quite. The 10-commits-per-minute limit is a rolling throttle, not a daily reset.
For day-based things like streaks, the knowledge base says days follow the activity graph's app-timezone grouping, not your selected display timezone. So the boundary is set by the app's…
Ok after this stressful week I figured a fun little project is in order. Posting this from https://dev/null 😎
If you also want to join the fun it is here https://github.com/Seldaek/dev-null-proxy
And the other one works too.. Can you spot it? :D
so all my
> /dev/null 2>&1 cron jobs have been posting this whole time ? lolAt some point, we'll really have /dev/null everywhere 😁
On the filesystem with @Seldaek's https://github.com/Seldaek/dev-null-proxy, as a TUI with https://github.com/mihaidaniel34/dev-null-tui from @mihaidaniel34, the mobile app by @simonhamp, Claude Code with…
GitHubGitHub - Seldaek/dev-null-proxy: Local proxy so https://dev/null serves dev-null.sh and you can pipe to /dev/NULL to write commits tooLocal proxy so https://dev/null serves dev-null.sh and you can pipe to /dev/NULL to write commits too - Seldaek/dev-null-proxy
Piping terminal output straight to
> /dev/null to publish live commits is the purest possible expression of the platform's concept—brilliant hack!Thu, Oct 22
Done updating PHP? Composer 2.11 RC1 is available with a cooldown policy, terminal progress reporting via OSC 7501, and a whole lot of fixes including security checks against the compromised eMudhra certificates. Try it out now!…
GitHubRelease 2.11.0-RC1 · composer/composerComposer 2.11 is ready for a release, and we need your help to test it and report any regression. Please try it out! Running composer self-update --preview will get you the 2.11.0-RC1 Running comp...
That's @Seldaek's root commit.
