What’s New in Pricore: Better Package Pages, Broader Mirrors, and Safer Installs

Maarten Bode
Maarten Bode

Since the release of Security Auditing in March, Pricore has shipped 18 releases. The work since then has focused on three things: making packages easier to explore, connecting more of the Composer ecosystem, and making installs more predictable.

Here’s what changed from v0.50.1 through v0.54.1.

A better package detail page

The package page was redesigned in v0.53.0 to put the information you need in one place.

READMEs now render directly inside Pricore, so you can understand what a package does without opening its repository. Versions and download statistics have their own tabs, making it easier to move between documentation, release history, and usage data.

We also made package versions more useful throughout the dashboard. Version tags, release pages, and commit hashes now link back to GitHub, GitLab, or Bitbucket. When you need the source behind a release, it’s one click away.

Mirror any Composer v2 registry

Registry Mirrors originally focused on Packagist-compatible sources. As of v0.53.2, Pricore can mirror packages from any Composer v2-compatible registry.

That makes it possible to bring more private and commercial package sources behind the same Pricore endpoint. Your team still gets one repository configuration and one set of credentials, while Pricore handles the upstream registries.

More reliable Composer installs

A large part of this release cycle went into edge cases that only show up once a registry is part of real deployment workflows.

Pricore now preserves the v prefix on version tags. This prevents composer outdated and composer show from reporting duplicate versions or phantom updates. Existing lock files that use the older version format continue to work, too.

v0.54.1 also improves installs for moving branch versions. When a lock file pins an older branch commit, Pricore keeps the archive for that commit available instead of returning a 404 after the branch moves forward. Superseded archives are retained indefinitely by default, with DIST_KEEP_DETACHED_DAYS available if you prefer a retention window.

Version names containing slashes are supported as well, covering branch and release naming schemes such as feature/my-feature.

Easier day-to-day administration

Organization member management now includes search, role filters, and sorting by member, role, or join date. This is a small change for a team of three, but a meaningful one when an organization grows.

Pricore also keeps you informed about its own updates. Click the version number in the sidebar to read recent release notes. If a newer version is available, an indicator lets you know without requiring a separate update check or scheduled task.

There are improvements across the provider integrations, too:

  • Private GitHub repositories are listed correctly during import.
  • Self-hosted GitLab connections retain their instance URL after OAuth.
  • Bitbucket repository imports work with Atlassian’s updated workspace APIs and large workspaces no longer get stuck during pagination.
  • Generic Git repositories work in the official Docker image.

Security and deployment hardening

v0.54.0 tightened repository URL validation before identifiers are passed to Git. Generic Git connections are limited to network protocols and SCP-style SSH URLs, while hosted providers accept the expected owner/repository format. Existing repositories are checked again during their next sync.

We also fixed organization-scoped authorization in multi-tenant installations and aligned manual installation with Pricore’s invite-only default.

Reverse-proxy and Docker deployments received several fixes along the way. HTTPS URLs are now generated consistently when APP_URL uses HTTPS, and that configuration is passed to workers, the scheduler, and Reverb. This prevents queued syncs from storing http://localhost download URLs.

Update to the latest release

If you self-host Pricore, we recommend updating to v0.54.1, especially for the repository validation and organization authorization fixes included in this release range. Pricore Cloud is already up to date.

update composer self-hosted
Back to blog