What this registry measures and what it does not

What we collect

We collect public Packagist packages that published a release in the last 12 months, every version of those packages, and the requirements each version declares in composer.json. The target list — the Magento and Mage-OS versions and the PHP minor each one supports — comes from magento.watch. The core package versions used to evaluate a declaration (for example the magento/framework line that belongs to one Magento version) come from the Mage-OS mirror and repo.mage-os.org.

How declared support is computed

Declared support is computed, not tested. For every version and target we evaluate the version's composer.json requirements against the target's core package versions with composer/semver, the reference implementation of Composer's version rules. A PHP requirement is evaluated against the PHP minor the target uses. The outcome is one of three states, plus “not evaluated” when no declaration is on record:

allows

composer.json declares support for this target: the constraints admit the target's core versions.

rejects

composer.json declares no support for this target: the constraints exclude the target.

unspecified

composer.json does not constrain this target: the relevant requirement is absent or open.

not evaluated

no declared state has been recorded for this version and target yet.

A declaration is a claim by the package author, not a measurement by us. We publish it next to the exact Magento or Mage-OS version, PHP minor and frontend it refers to.

Recommended version

For a given target, the recommended version is the newest stable version whose composer.json declares support for that target. It reflects a declaration, not a test result, and a newer version may have dropped the declaration.

Not available yet

• Static checks (T1): lint, PHP-version and symbol scans have not run on any package version.
• Install and compile tests (T2): no package has been installed and compiled on a target.
• Release analysis: no version-to-version change report is published.
• Security signals: no configuration or pattern findings are published.
• Advisories: no vulnerability data is shown.
• Categories: no taxonomy or category browsing exists yet.
• AI descriptions: no descriptions are generated yet; a package page shows the composer.json description, labelled “From composer.json”.

Three words we do not use as verdicts

We never describe a package as compatible, we never say that it works, and we never call a version ready. Each of those words claims more than any declaration or single check can support. A declaration is a vendor claim; a check is one measurement on one target; neither shows that a package will operate correctly in your store. For the same reason we do not call a package safe and we do not describe one as supported by us. Every label on this site names what was measured and the exact target it refers to.

Upgrade check privacy, API and MCP

Your upgrade check input is processed in memory for a single response and then discarded. Package names not present in the catalogue are dropped before anything is shown. Nothing is stored, request bodies are never logged, and package names are never sent to analytics.

The REST API is at /api/v1 and the MCP server is at /mcp. Searches (by text, vendor or tag, and their next pages) and the upgrade check are rate limited per IP address, or per /64 block for IPv6.

Data licence and attribution

Package and version metadata comes from Packagist and from each package's own composer.json, remains subject to each package's own licence, and links back to the original source. Magento and Mage-OS version metadata comes from magento.watch. Core package version maps come from the Mage-OS mirror and repo.mage-os.org. Vulnerability advisories, when published, come from the GitHub Advisory Database with attribution.

Magento is a trademark of Adobe Inc. We use the Magento name only to identify the software these packages extend — a nominative use — and this site is not affiliated with or endorsed by Adobe. Mage-OS is a community project of the Mage-OS Association.

Spotted wrong data? Report a correction on GitHub, the same contact as the site footer.