Freedom251 › Artifact repository software
Private Packagist
What Private Packagist is
Private Packagist is a controlled repository service for private PHP packages installed through Composer. It connects to private Git, Mercurial, and Subversion repositories over SSH or HTTP Basic authentication, while mirroring third-party Composer dependencies so installations can continue when upstream hosts are unavailable. Server-side controls can block versions flagged as malware and enforce approved Composer versions and plugin policies. Vulnerability monitoring checks composer.lock files and can send alerts by email, webhook, Slack, or Microsoft Teams. Update Review adds pull-request comments summarizing dependency-file changes with links to diffs and changelogs. License Review shows dependency licenses and supports browsing by license. GitHub, Bitbucket, and GitLab synchronization can manage teams, members, permissions, and repositories. API access is included in all plans. Cloud plans include email and chat support. Pricing starts at €649/yr, with a 14-day trial and no free plan.
Who it suits
It suits businesses, agencies, and vendors managing private PHP packages and Composer installations. Teams needing repository controls, dependency monitoring, or organization synchronization can use its cloud or self-hosted options.
What it does well
- Mirrors third-party Composer dependencies
- Blocks malware-flagged package versions
- Scans composer.lock for vulnerabilities
- Supports GitHub, Bitbucket, and GitLab sync
- API access included across plans
What to know first
- No free plan
- Pricing starts at €649/yr
- Self-hosted vendor add-on unavailable
- Single package ecosystem
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Private Packagist Cloud | €15.58 / mo billed as €187 / year per user / per suborganization · First 3 users and 3 suborganizations included · one free suborganization for each user · unlimited private packages, repositories, and mirrors · 14-day free trial | €187 a year |
| Private Packagist Self-Hosted — Kubernetes, Helm Chart | Starts at €3900/yr including 10 users and suborganizations — each additional user/suborganization €199/yr · Unlimited private and open-source packages · unlimited mirrored third party repositories · Kubernetes installation in your own cluster using Helm chart · 30-day free trial | €3,900 a year |
| Private Packagist Self-Hosted — Kubernetes, Kots | Starts at €5900/yr including 10 users and suborganizations — each additional user/suborganization €199/yr · Unlimited private and open-source packages · unlimited mirrored third party repositories · Kubernetes installation on a Linux server behind your firewall or in your VPN · 30-day free trial | €5,900 a year |
As packagist.com lists them, read 4 Oct 2026. The maker's own page has the final word.
Verdict
Private Packagist combines private Composer hosting with dependency mirroring, policy controls, vulnerability alerts, and review tools. Its paid pricing and PHP-focused ecosystem make it a specialized choice for organizations managing Composer-based software.
Facts from Private Packagist's own pages
- API
- The pricing page lists API access among the features included in all plans. · packagist.com, 4 Oct 2026
- Company origin
- Private Packagist was founded by Composer creators Jordi Boggiano and Nils Adermann. · packagist.com, 4 Oct 2026
- Headquarters
- Berlin, Germany · packagist.com, 28 Sept 2026
- Integrations
- Organization synchronization is available for GitHub, Bitbucket, and GitLab, including synchronization of teams, members, permissions, and repositories. · packagist.com, 4 Oct 2026
- Intended users
- The company describes Private Packagist as providing businesses with functionality tailored to their requirements and offers solutions for agencies and vendors. · packagist.com, 4 Oct 2026
- License review
- License Review lists open-source licenses used by dependencies across an organization and lets users browse packages by license. · packagist.com, 4 Oct 2026
- Mirroring
- It mirrors third-party Composer dependencies so installs can continue when upstream repositories or package hosts are unavailable. · packagist.com, 4 Oct 2026
- Package sources
- It can access private code in Git, Mercurial, or Subversion repositories using SSH or HTTP Basic authentication. · packagist.com, 4 Oct 2026
- Pull request review
- Update Review comments on pull requests with a readable summary of composer.lock changes and links to code diffs and changelogs. · packagist.com, 4 Oct 2026
- Purpose
- Private Packagist makes private PHP repositories available through Composer and provides a controlled repository for package installs. · packagist.com, 4 Oct 2026
- Self-hosted limits
- The self-hosted version supports an unlimited number of organizations, but its vendor add-on is unavailable. · packagist.com, 4 Oct 2026
- Supply chain controls
- The service blocks package versions flagged as malware and can enforce allowed Composer versions and Composer plugin policies server-side. · packagist.com, 4 Oct 2026
- Support
- Cloud plans include email and chat support, and the pricing FAQ says messages sent by email or website chat receive a guaranteed next-business-day response. · packagist.com, 4 Oct 2026
- Vulnerability monitoring
- It scans composer.lock files for vulnerable dependency versions and can notify users by email, webhook, Slack, or Microsoft Teams. · packagist.com, 4 Oct 2026
Where Private Packagist stands on Freedom251
- Artifact repository software#55 of 64
- Package Registries#25 of 28