Packagist just turned 15. On September 27, 2011, Jordi Boggiano submitted monolog/monolog and it became package ID 1. Today Packagist lists more than 469,000 packages, and Composer has installed packages from it more than 200 billion times.

Nils Adermann and Jordi marked the anniversary with a look back on the Packagist blog. The post covers how Composer started, the milestones since, and what the team is working on next.

How It Started

Composer came out of two projects with the same problem. phpBB needed a plugin system with installs, upgrades and dependency management, and Symfony needed something better than the shell script it used to download its components. Nils pushed the first Composer commit on April 5, 2011. Four days later Jordi registered packagist.org, which started out as a proxy for the PEAR channels of the day.

The Numbers

Here are some of the figures from the post:

  • 201.6 billion package installs since Packagist started counting in April 2012
  • 469,000+ packages and 5.8 million+ versions
  • 1 billion+ installs of monolog/monolog alone
  • 13,000+ commits to Composer from over 1,000 contributors

Packagist ran on a single personal server with 100 Mbps of bandwidth until April 2015. It took until August 2015 to reach the first billion installs. The jump from 100 billion to 200 billion took two years and eight months.

Growth has picked up in 2026. Monthly installs went from 3 billion in January to 4.9 billion in August, and September has already passed 5 billion. The team says the rise coincides with more developers using AI coding tools. With over 36 billion installs so far, 2026 has already passed the total for all of 2025.

What Comes Next

Supply chain security has taken up most of this year, and we covered some of that work in Composer After the Attack. The roadmap in the post includes:

  • A minimum release age (cooldown) policy in Composer 2.11
  • MFA status on maintainer profiles, and eventually mandatory MFA for all accounts
  • Organizations that own packages and vendor prefixes, replacing shared company accounts
  • A FIDO2-backed staged release flow for widely used packages
  • Immutable build artifacts with Sigstore attestations verified by Composer

The team also wants the companies that rely most on Packagist to help pay for it. For most of its history, Private Packagist, the company Nils and Jordi founded in 2016, has covered the majority of the cost. Packagist stays free for individual developers and small and medium companies.

Read More

Read the full anniversary post for the complete history, including the gold master Composer 1.0 floppy disk. Happy birthday, Packagist!