Jordi Boggiano (@Seldaek)

Today

@composer 2.11.2 just dropped with the latest batch of security fixes freshly baked from your local LLM https://github.com/composer/composer/releases/tag/2.11.2

GitHubRelease 2.11.2 · composer/composerSecurity: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm) Security: Fix...

Raphael Stolt @raphaelstoltquoted7h

$ composer self-update

Yesterday

Jordi Boggiano @Seldaek18h2b1626d

Great start :D

PVPauline Vos@paulinevos18h

avalancve

Jordi Boggiano @Seldaek18h8b53cc8

Is there a word for these agent driven cascades of new issues / PRs / security reports that you get as an open source maintainer? It's not just the total volume of it but the fact that you sometimes get 5 of them within seconds as an agent unleashes their wrath on your repo can…

Show thread

Brent Roose @brendt5h

I also find it very overwhelming…

legecha @legecha7h

Oh, the “Monday mourning” backlog?

Grégoire Paris @greg0ire17h

TsunAImi

Mon, Nov 2

Jordi Boggiano @SeldaekNov 2eb3da7b

Cool, orgs! It seems you can't quote a commit from an org account tho? Is that by design or an oversight?

CComposer@composerNov 2

🎼🎶👋

Show thread

Matthieu Napoli @mnapoliNov 2

mmmh I was sure it was possible… That's an oversight 😛

Sun, Nov 1

Jordi Boggiano @SeldaekNov 11467b4f

From my experience running packagist this will not be enough for long 😅 random people will claim orgs and then disappear, etc. But it's a good starting point for sure. Easy enough to change later.

TTom@tomNov 1

Only a member of a GitHub organization can claim its /dev/null page. The first member to claim it becomes its admin, and after that the page can't be claimed again. Claiming asks for no extra GitHub permission: it just checks that GitHub lists you among the org's public members.…

Pauline Vos @paulinevosNov 1

I have the same concerns and the same thoughts about some vague escape hatch for this issue in the future 💀 Nicht mein Bier as they say. @mnapoli territory

Show thread

Sat, Oct 31

Jordi Boggiano @SeldaekOct 318fa9858

It's saturday so obviously I'm applying patches/workarounds to Packagist servers for the latest CVE, and hardening other stuff while I'm at it. I really hope the pace of all this calms down eventually 🫩

Thu, Oct 29

Jordi Boggiano @SeldaekOct 29eb7411f

All of a sudden it seems a lot more worth it that @composer 2.11 comes with protection against stale CA bundles that still include eMudhra certs. https://x.com/QuinnyPig/status/2115853299287257221

X (formerly Twitter)Corey Quinn (@QuinnyPig) on XHoly balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/! What the hell are you doing over there, Apple friends?

nunomaduro @nunomaduroOct 29

ouch...

Jordi Boggiano @SeldaekOct 298075cd8

@composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. Composer 2.11 includes several security fixes, block-scope support for custom…

Private PackagistComposer 2.11We are pleased to announce the release of Composer 2.11.0. The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions for a configurable period of time before Composer will install them. Composer 2.11 also ships several security fixes, removes the

Joao Neves @JN1153Oct 30

Awesome!

Suliman Benhalim @sulimanbenhalimquotedOct 29

json

"config": { "policy": { "cooldown": { "period": "1 day" } } }

composer update on a friday just got a little less brave 😅 who is turning it on ?

Matthieu Napoli @mnapoliOct 29

thank you!

Wed, Oct 28

Jordi Boggiano @SeldaekOct 280a3c15f

Sun, Oct 25

Jordi Boggiano @SeldaekOct 25ce1e22f

Let that in the [data] sink. Made with Grok :D

Sat, Oct 24

Jordi Boggiano @SeldaekOct 241b8394c

@nicholasruunu hey how's it going? Been a while!

Fri, Oct 23

Jordi Boggiano @SeldaekOct 23370fc0a

Can we get rolling window rate limiting for pasteis too?

TTom@tomOct 23

Not quite. The 10-commits-per-minute limit is a rolling throttle, not a daily reset. For day-based things like streaks, the knowledge base says days follow the activity graph's app-timezone grouping, not your selected display timezone. So the boundary is set by the app's…

JonJKF @jonJKFOct 24

No, I think pastéis should be baked in batches around ~05:00 so they are fresh for the morning.

nunomaduro @nunomaduroOct 23

humm; don't have we have the 10 per day thing?

Jordi Boggiano @SeldaekOct 23196e2c3

Ok after this stressful week I figured a fun little project is in order. Posting this from https://dev/null 😎 If you also want to join the fun it is here https://github.com/Seldaek/dev-null-proxy

JBJordi Boggiano@SeldaekOct 23

And the other one works too.. Can you spot it? :D

Suliman Benhalim @sulimanbenhalimOct 23

so all my > /dev/null 2>&1 cron jobs have been posting this whole time ? lol

Julien Bianchi @jubianchiquotedOct 23

At some point, we'll really have /dev/null everywhere 😁 On the filesystem with @Seldaek's https://github.com/Seldaek/dev-null-proxy, as a TUI with https://github.com/mihaidaniel34/dev-null-tui from @mihaidaniel34, the mobile app by @simonhamp, Claude Code with…

GitHubGitHub - Seldaek/dev-null-proxy: Local proxy so https://dev/null serves dev-null.sh and you can pipe to /dev/NULL to write commits tooLocal proxy so https://dev/null serves dev-null.sh and you can pipe to /dev/NULL to write commits too - Seldaek/dev-null-proxy

Pauline Vos @paulinevosOct 23

This is gonna confuse a bunch of one-off scripts your clanker generates 😂

Jordi Boggiano @SeldaekOct 231585ea0

Terminal test

Show thread

Md. Khorshed Alam @robelsustOct 24

Piping terminal output straight to > /dev/null to publish live commits is the purest possible expression of the platform's concept—brilliant hack!

CallMeMrYogurt @callmemryogurtOct 23

failed

nunomaduro @nunomaduroquotedOct 23

welcome @Seldaek

Thu, Oct 22

Jordi Boggiano @SeldaekOct 22c47feaf

Done updating PHP? Composer 2.11 RC1 is available with a cooldown policy, terminal progress reporting via OSC 7501, and a whole lot of fixes including security checks against the compromised eMudhra certificates. Try it out now!…