Introduction
Packagist.org has deprecated support for Composer 1.x, impacting JFrog Artifactory users whose remote repositories proxy Packagist.org. Effective August 1st, 2025, Packagist.org will entirely shut down metadata access for Composer 1.x, which will prevent package updates from working.
If your local client uses Composer 1.x, Artifactory will proxy the request to Packagist and return the following failure, even when pointing to your Artifactory URL:
Composer 1.x is no longer supported, please upgrade to Composer 2.2.0 or higher to access packagist.org.
This article explains how to resolve this client-side issue by upgrading your local Composer version. No configuration changes are needed in Artifactory.
Resolution
Affected Versions
-
Composer Client: All 1.x versions.
-
JFrog Artifactory: All 1.x versions are affected in their proxying capacity, but the issue does not originate in Artifactory.
Step-by-Step Instructions
1. Identify Your Composer Version
First, confirm if you are using an affected version. Run the following command in your terminal:
composer --version
If the output shows a version beginning with 1.x, an upgrade is required.
2. Upgrade Your Local Composer Client
Run the self-update command to upgrade to the latest stable Composer 2.x version:
composer self-update --2
This command will update your local Composer installation. Once complete, verify that the upgrade was successful:
composer --version
The output should now show a version > 2.0.0. Your client can now communicate correctly with Artifactory's remote repository, which will successfully proxy requests to Packagist.org.
Conclusion
The deprecation of Composer 1.x by Packagist.org requires a mandatory client-side update for users who proxy packages through JFrog Artifactory. By upgrading your local Composer to version 2.x, you ensure that Artifactory can continue to proxy requests and serve your PHP dependencies seamlessly.