Packagist Scraper: PHP Composer Packages

Packagist Scraper turns any list of vendor/package names into flat, structured records, latest version, full require and require-dev maps, autoload config, licences, authors, PHP requirement, abandonment status, security advisories and download counts.

It reads Packagist's Composer metadata directly, the same CDN-cached files composer update downloads. No proxy setup, no browser, no credentials to manage. A metadata lookup is a single request.

Agent skill: SKILL.md

https://api.apify.com/v2/key-value-stores/t7YoTxpZEJOWvw4Ug/records/packagist-scraper.md

What you get

Output field	Meaning
name, vendor, packageName	Canonical identifier, split for easy grouping by vendor
description, type, keywords, homepage	Package summary, Composer type (library, symfony-bundle, …) and tags
latestVersion, latestVersionNormalized, lastRelease	Newest release and when it was tagged
firstRelease, releaseCount, stableReleaseCount	Project age and how many versions exist, stable and total
license, authors, maintainers	Declared SPDX licences, gemspec-style author blocks and Packagist account names
phpRequirement, require, requireDev, suggest	The PHP constraint on its own, plus the full dependency maps
autoload	PSR-4 / PSR-0 / classmap / files configuration
abandoned, abandonedInFavourOf	Whether the package is abandoned and what its author points to instead
source, dist	Git URL and commit reference, and the zipball URL Composer downloads
support, funding, repository, language	Issue tracker and docs links, funding channels, upstream repo
securityAdvisories	Advisory IDs and affected version ranges, shipped in the metadata file
downloadsTotal, downloadsMonthly, downloadsDaily, favers, dependents, suggesters	Install volume and ecosystem reach (opt-in)
githubStars, githubForks, githubOpenIssues	Upstream repository signals (opt-in)
releases, devBranches	Version history and open development branches (opt-in)
scrapedAt	Run timestamp

A RUN_SUMMARY record in the key-value store holds per-run counts, the filters used, unknown and malformed names, and any lookup that failed.

Common use cases

• Abandonment audits. abandoned plus abandonedInFavourOf and a stale lastRelease tell you exactly what to migrate off.
• Composer SBOMs. require, requireDev, dist and source give you the full pinned graph with commit references.
• PHP-version migration planning. phpRequirement per version shows when each dependency picked up PHP 8.4 support.
• Ecosystem research. Run with no input to pull the most-installed packages ranked by Packagist itself.

Quick start

Three packages, default depth:

{
 "packages": ["monolog/monolog", "guzzlehttp/guzzle", "symfony/console"]
}

An abandonment and dependency audit with history:

{
 "packages": ["laravel/framework", "swiftmailer/swiftmailer", "phpunit/phpunit"],
 "includeVersionHistory": true,
 "maxVersions": 30,
 "includeDevBranches": true
}

Fastest possible sweep, metadata only, no rate-limited stats call:

{
 "packages": ["symfony/console", "symfony/process"],
 "includeStats": false
}

Input

Field	Type	Default	Notes
packages	array	[]	vendor/package names, packagist.org URLs or composer require lines. Empty pulls the most-installed packages.
onlyStable	boolean	true	Ignore alpha/beta/RC/dev versions when picking the version each record describes.
includeVersionHistory	boolean	false	Add the releases array. Costs no extra request.
maxVersions	integer	20	Cap on entries in releases, newest first.
includeDevBranches	boolean	false	Add devBranches from the ~dev metadata file. One extra request per package.
includeStats	boolean	true	Add downloads, favers, dependents and GitHub counts. One extra request per package.
maxPackages	integer	25	Cap on packages per run.

Names are lowercased, deduped and stripped of constraints before any request. Anything without a slash is skipped and reported in RUN_SUMMARY.malformedNames rather than sent to the API.

Output example

{
 "name": "monolog/monolog",
 "vendor": "monolog",
 "packageName": "monolog",
 "description": "Sends your logs to files, sockets, inboxes, databases and various web services",
 "type": "library",
 "keywords": ["log", "logging", "psr-3"],
 "homepage": "https://github.com/Seldaek/monolog",
 "repository": "https://github.com/Seldaek/monolog",
 "language": "PHP",
 "latestVersion": "3.10.0",
 "latestVersionNormalized": "3.10.0.0",
 "lastRelease": "2026-01-02T08:56:05+00:00",
 "firstRelease": "2011-07-07T16:21:02+00:00",
 "releaseCount": 87,
 "stableReleaseCount": 83,
 "license": ["MIT"],
 "authors": [{ "name": "Jordi Boggiano", "email": "j.boggiano@seld.be", "homepage": "https://seld.be", "role": null }],
 "maintainers": ["Seldaek"],
 "phpRequirement": ">=8.1",
 "require": { "php": ">=8.1", "psr/log": "^2.0 || ^3.0" },
 "requireDev": { "phpunit/phpunit": "^10.5.17 || ^11.0.7" },
 "suggest": { "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server" },
 "autoload": { "psr-4": { "Monolog\\": "src/Monolog" } },
 "abandoned": false,
 "abandonedInFavourOf": null,
 "source": { "url": "https://github.com/Seldaek/monolog.git", "type": "git", "reference": "b321dd67…" },
 "dist": { "url": "https://api.github.com/repos/Seldaek/monolog/zipball/b321dd67…", "type": "zip", "shasum": "" },
 "support": { "issues": "https://github.com/Seldaek/monolog/issues" },
 "funding": [{ "url": "https://github.com/Seldaek", "type": "github" }],
 "securityAdvisories": [{ "advisoryId": "PKSA-dmw8-jd8k-q3c6", "affectedVersions": ">=1.8.0,<1.12.0" }],
 "downloadsTotal": 1036088143,
 "downloadsMonthly": 18121188,
 "downloadsDaily": 772059,
 "favers": 22261,
 "dependents": 8416,
 "suggesters": 633,
 "githubStars": 21396,
 "githubForks": 1907,
 "githubOpenIssues": 32,
 "scrapedAt": "2026-08-06T11:52:18.911Z"
}

API example

curl -X POST "https://api.apify.com/v2/acts/arman-bd~packagist-scraper/run-sync-get-dataset-items?token=YOUR_TOKEN" \
 -H "Content-Type: application/json" \
 -d '{
 "packages": ["monolog/monolog", "laravel/framework"],
 "includeVersionHistory": true,
 "maxVersions": 10
 }'

Limits and behaviour

• The metadata is minified, and this Actor expands it. Packagist serves composer/2.0 format: only the first version object is complete, every later one lists just the keys that changed, and the literal string "__unset" removes a key. Read naively, version 3.6.0 of Monolog looks like it has no licence, no authors and no dependencies. The Actor replays the diffs forward exactly as Composer does, so every entry in releases is fully resolved.
• Versions arrive newest first. Index 0 of the metadata array is the latest tag, not the oldest, and filtering never reorders it.
• Two hosts, two budgets. Package metadata comes from repo.packagist.org, which is CDN-cached and cheap. Download counts, favers and GitHub stats only exist on packagist.org, which is rate limited. That is why includeStats is a separate switch, and why requests are spaced 400 ms apart across both.
• Stats failing does not lose the package. If the stats call errors, the record is still written with the metadata fields populated and the stats fields null; the miss is noted in RUN_SUMMARY.failures.
• releaseCount counts tagged versions only. Dev branches are not tags and live in a separate metadata file, reachable via includeDevBranches.
• A missing package is a per-item failure. The CDN answers 404 with an HTML body rather than JSON; that name lands in RUN_SUMMARY.unknownPackages and the run carries on. The Actor errors out only when every lookup failed.
• Transient errors are retried. 429 and 5xx get three attempts with backoff, honouring Retry-After when Packagist sends one.

Defaults: 1 GB memory, 15 minute timeout.

FAQ

Do I need a Packagist account or API key? No. You supply no credentials.

Does it need a proxy? No. There is nothing for a proxy to solve.

Why is firstRelease earlier than the date on the Packagist page? Packagist shows when the package was submitted to the index; firstRelease is the tag date of its oldest published version, which is usually earlier.

What counts as unstable? Composer's own rule: a version_normalized carrying -dev, -alpha, -beta, -rc or -patch, or a version starting dev-. With onlyStable on, those are excluded from latestVersion, releases and firstRelease, but still counted in releaseCount.

Are the security advisories complete? They are the advisory IDs and affected ranges Packagist ships alongside the metadata. For full descriptions, severities and CVE aliases, feed the same package list into the OSV Scraper with ecosystem Packagist.

Can I get a private or self-hosted package? No. This reads the public Packagist index only; Private Packagist requires authentication and is out of scope.

Can I integrate it with something else? Yes, Apify API, client libraries, webhooks, scheduled runs, dataset exports (JSON/CSV/Excel) or MCP. Output is structured JSON.