{"id":20214,"date":"2026-03-25T15:27:24","date_gmt":"2026-03-25T15:27:24","guid":{"rendered":"https:\/\/wordpress.org\/news\/?p=20214"},"modified":"2026-03-25T17:19:27","modified_gmt":"2026-03-25T17:19:27","slug":"wp-packages","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2026\/03\/wp-packages\/","title":{"rendered":"WP Packages is Working the Way Open Source Should"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">When WP Engine acquired WPackagist on March 12, the WordPress developer community faced a familiar question: what happens when critical open source infrastructure ends up under corporate control? The community already had an answer in progress. Four days later, <a href=\"https:\/\/wp-packages.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">WP Packages<\/a> (<a href=\"https:\/\/roots.io\/wp-composer-is-now-wp-packages\/\">formerly WP Composer<\/a>) launched as a fully independent, community-funded alternative, with some neat additional features.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Built by <a href=\"https:\/\/profiles.wordpress.org\/retlehs\/\">Ben Words<\/a> from <a href=\"https:\/\/roots.io\/\" target=\"_blank\" rel=\"noreferrer noopener\">Roots<\/a>, the team behind Bedrock, Sage, and Trellis, WP Packages is a new open source Composer repository for WordPress plugins and themes. <a href=\"https:\/\/getcomposer.org\/\">Composer<\/a> is PHP&#8217;s dependency manager, and it is how many professional WordPress developers install and update plugins and themes in their projects. Every free plugin and theme in the WordPress.org directory is available through WP Packages. <a href=\"#switch\">Migrating from WPackagist<\/a> can be done via a single script or a few terminal commands.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Happened and Why It Matters<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WPackagist was created in 2013 by Outlandish, a UK-based digital cooperative, and it served the WordPress Composer ecosystem for over a decade. In its later years the project suffered from deferred maintenance, slow update cycles, and little to no community input. When WP Engine announced the acquisition, developers raised immediate concerns about a private-equity-backed corporation controlling infrastructure this foundational to the WordPress developer workflow. WP Engine immediately updated the Composer <code>info<\/code> field to display a &#8220;WPackagist is now maintained by WP Engine&#8221; notice in every developer&#8217;s terminal. A small thing, but telling. That&#8217;s how corporate ownership changes the relationship between a tool and its users.<\/p>\n\n\n\n<div class=\"wp-block-group is-layout-constrained wp-container-core-group-is-layout-c1abb2c1 wp-block-group-is-layout-constrained\">\n<figure class=\"wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\"><blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">And it only took less than 24h for this to pop up on every composer run:<br>&quot;Info from <a href=\"https:\/\/t.co\/1EEb4PZ9N2\">https:\/\/t.co\/1EEb4PZ9N2<\/a>: WPackagist is now maintained by WP Engine. Learn more at <a href=\"https:\/\/t.co\/89b2hBWxd9\">https:\/\/t.co\/89b2hBWxd9<\/a>&quot;<br>Which I&#39;m sure is a permanent message that will just shift to marketing. Prove me wrong\ud83e\udd21 <a href=\"https:\/\/t.co\/HdcuQPkUqV\">https:\/\/t.co\/HdcuQPkUqV<\/a><\/p>&mdash; Jonathan de Jong (@jonathan_dejong) <a href=\"https:\/\/twitter.com\/jonathan_dejong\/status\/2032389680415625239?ref_src=twsrc%5Etfw\">March 13, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/div><\/figure>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ben had already started building a WPackagist replacement last August, long before the acquisition made headlines. When WP Engine&#8217;s deal landed, he accelerated the launch, <a href=\"https:\/\/roots.io\/introducing-wp-composer-as-a-wpackagist-replacement\/\">going live on March 16<\/a> with a fully <a href=\"https:\/\/github.com\/roots\/wp-composer\">open source repository on GitHub<\/a>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>Open source repo \u2260 transparent system. WP Packages makes everything public, including infrastructure and build process.<\/em> &#8211; <a href=\"https:\/\/x.com\/retlehs\/status\/2034277432241385727?s=20\">Ben Word on X<\/a><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s also just a better tool. WP Packages supports Composer v2&#8217;s metadata-url protocol, which lets Composer fetch metadata only for the packages a project actually needs. WPackagist still relies on the older provider-includes approach, forcing Composer to download large index files before resolving dependencies. Cold dependency resolves on WP Packages are roughly 17x faster: 0.7 seconds for 10 plugins compared to 12.3 seconds on WPackagist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WP Packages also uses CDN caching with public cache headers and serves immutable, content-addressed per-package files. Package naming is cleaner (<code>wp-plugin\/<\/code> and <code>wp-theme\/<\/code> instead of <code>wpackagist-plugin\/<\/code> and <code>wpackagist-theme\/<\/code>), metadata includes plugin and theme authors, descriptions, and homepage URLs that WPackagist has been missing for years, and updates sync every five minutes rather than WPackagist&#8217;s roughly 90-minute cycle.<\/p>\n\n\n\n<h2 id=\"switch\" class=\"wp-block-heading\"><strong>How to Switch<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Switching from WPackagist to WP Packages requires just a few terminal commands.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Remove your existing WPackagist packages:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"><code>composer remove wpackagist-theme\/twentytwentyfive<\/code><\/code><\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Remove the WPackagist repository and add WP Packages:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"><code>composer config --unset repositories.wpackagist &amp;&amp; composer config repositories.wp-composer composer https:\/\/repo.wp-packages.org<\/code><\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Require packages with the new naming:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"><code>composer require wp-theme\/twentytwentyfive<\/code><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, use the <a href=\"https:\/\/github.com\/roots\/wp-composer\/blob\/main\/scripts\/migrate-from-wpackagist.sh\">migration script<\/a> to automatically update your <code>composer.json<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">curl -sO https:\/\/raw.githubusercontent.com\/roots\/wp-packages\/main\/scripts\/migrate-from-wpackagist.sh &amp;&amp; bash migrate-from-wpackagist.sh<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Roots also provides a <a href=\"https:\/\/github.com\/roots\/wp-packages-changelog-action\">WP Packages Changelog Action<\/a> for GitHub workflows that tracks dependency updates using the new naming format. Projects using <a href=\"https:\/\/roots.io\/bedrock\/\">Bedrock<\/a> already ship with WP Packages configured out of the box.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Open Source Wins<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The entire WP Packages project is public. The application code, documentation, and even the full Ansible deployment configuration are available on GitHub. Anyone can fork the repository and run their own WordPress Composer registry. Ben has also committed publicly that WP Packages will never use the Composer <code>info<\/code> field to push messages, ads, or upsells into developer terminals. That kind of restraint is easier to promise when a project answers to its community rather than to a corporate parent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WP Packages is funded through <a href=\"https:\/\/github.com\/sponsors\/roots\">GitHub Sponsors<\/a>. Current sponsors include <a href=\"https:\/\/carrot.com\/\">Carrot<\/a>, <a href=\"https:\/\/kinsta.com\/\">Kinsta<\/a>, <a href=\"https:\/\/wordpress.com\/\">WordPress.com<\/a>, and <a href=\"https:\/\/www.itineris.co.uk\/\">Itineris<\/a>. The WordPress ecosystem has always been at its strongest when the community builds the tools it needs in the open. Ben saw a gap forming months before anyone else was paying attention, built something better than what existed, and released it for everyone. No acquisition required. No boardroom decisions about availability or pricing. Just developers solving a problem for other developers and sharing the result. Open source wins.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When WP Engine acquired WPackagist on March 12, the WordPress developer community faced a familiar question: what happens when critical open source infrastructure ends up under corporate control? The community already had an answer in progress. Four days later, WP Packages (formerly WP Composer) launched as a fully independent, community-funded alternative, with some neat additional [&hellip;]<\/p>\n","protected":false},"author":7511363,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","podmotor_file_id":"","podmotor_episode_id":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","filesize_raw":"","date_recorded":"","explicit":"","block":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false},"categories":[5],"tags":[],"class_list":["post-20214","post","type-post","status-publish","format-standard","hentry","category-development"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-5g2","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/20214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/7511363"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=20214"}],"version-history":[{"count":19,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/20214\/revisions"}],"predecessor-version":[{"id":20323,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/20214\/revisions\/20323"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=20214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=20214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=20214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}