Novità

Star now saves a package to a list: Favorites at first, then the list you used last, and a notice says which list it went to. The arrow next to Star adds the package to other lists or to a new one (up to 50 lists), and Settings → Lists turns any list into a composer.json. In a package's version list you can star the versions you rely on, show only those, and switch between a detailed and a basic view, which the site remembers. See Stars, lists and watching.

Every account now needs two-factor authentication: an authenticator app or a passkey. You have 14 days to turn it on under Settings → Password and authentication; a reminder shows until you do. After that, the security settings are the only page that opens until it is on.

Public forms are also better protected against spam, and every page sends stricter security headers.

Plugin and theme makers can now claim their vendor profile under Settings → Vendor profiles. Once we have confirmed that they represent the vendor, the profile shows the Verified badge, and the vendor edits its own description and links, including where to buy a licence. See Claiming your vendor profile.

Vendors lists the developers behind the plugins and themes, with filters by type, source and number of packages. Each vendor page links to the vendor's own website, pricing, support and documentation: licences, support and updates are sold by them.

Published vulnerabilities (Wordfence Intelligence) are matched against every package in the repository:

• the Security tab of a package lists the known vulnerabilities and which versions fix them;
• Security advisories shows every advisory that affects the catalogue;
• if you watch an affected package, or one of your projects runs an affected version, you get a notification with the version to update to.

The portal speaks English, Spanish, German, French, Italian and Brazilian Portuguese. Each language has its own addresses (for example /de/packages), e-mails and notifications arrive in your language, and you can change it at any time in the footer or under Settings → Profile.

Tools for teams that automate:

• Webhooks notify your systems — signed JSON, Slack or Discord — when a watched package gets a new version, a security notice or a withdrawal.
• Atom feeds of releases for every package, every vendor and the whole repository.
• CI tokens restricted to packages and IP ranges, with an expiry date (see the CI guide in the documentation).
• Projects: upload a site's composer.lock to see which of its plugins and themes are behind, withdrawn or taken down.
• License key vault for the vendor keys you bought, with a reminder before they expire.
• API keys raise the rate limit of the public JSON API.

Teams can now work under an organisation instead of personal accounts.

• Invite members by e-mail and give them a role: owner, admin, member or billing manager.
• The Team plan is billed per seat; billing managers take no seat.
• Organisation tokens give CI and servers access without tying them to a person.
• An audit log records who changed what, and a data processing agreement is available to accept online.

The account area gained the protections you expect from a developer service:

• two-factor authentication with an authenticator app, and recovery codes;
• passkeys, to sign in without a password;
• sign-in with GitHub or Google;
• the list of your sessions, with sign-out from other devices;
• a security log of sign-ins and account changes, and an e-mail when a new device signs in;
• breached-password checks when you choose a password.

Find them under Settings → Password and authentication.

Each package has its own page, styled with GitHub's Primer design system, with light and dark themes.

• Versions: every served version with its release date, size, changed files and SHA-256, and the versions the vendor released that are not available here yet.
• Changelog: the vendor's notes per version, with filters by kind (new, improved, fixed, security), year and text.
• Files (signed-in accounts): the files of each version and the languages they are written in.
• Security: how each version was scanned, and known vulnerabilities.
• Insights: downloads, install reports and adoption charts.
• Star a package to keep it in your list, Watch it for new versions, security notices or withdrawals.

MeteorGPL is open: a private Composer repository for premium WordPress plugins and themes.

• Add the repository once, then composer require meteorgpl-plugin/<slug> or meteorgpl-theme/<slug>; composer/installers puts each package in wp-content/plugins or wp-content/themes.
• Every version is kept, so composer.lock installs the same files tomorrow as today, and a rollback is one constraint away.
• Every version was cleaned and scanned for malware and licence-bypass code before publication. The vendor's licence checks stay intact: activate with your own key.
• Personal Composer tokens authenticate Composer; create and revoke them under Settings → Composer tokens.