WP Packages is Working the Way Open Source Should

When WP Engine acquired WPackagist on March 12, the WordPress developer community faced a familiar question: what happens when critical open source infrastructure ends up under corporate control? The community already had an answer in progress. Four days later, WP Packages (formerly WP Composer) launched as a fully independent, community-funded alternative, with some neat additional features.

Built by Ben Words from Roots, the team behind Bedrock, Sage, and Trellis, WP Packages is a new open source Composer repository for WordPress plugins and themes. Composer is PHP’s dependency manager, and it is how many professional WordPress developers install and update plugins and themes in their projects. Every free plugin and theme in the WordPress.org directory is available through WP Packages. Migrating from WPackagist can be done via a single script or a few terminal commands.

What Happened and Why It Matters

WPackagist was created in 2013 by Outlandish, a UK-based digital cooperative, and it served the WordPress Composer ecosystem for over a decade. In its later years the project suffered from deferred maintenance, slow update cycles, and little to no community input. When WP Engine announced the acquisition, developers raised immediate concerns about a private-equity-backed corporation controlling infrastructure this foundational to the WordPress developer workflow. WP Engine immediately updated the Composer info field to display a “WPackagist is now maintained by WP Engine” notice in every developer’s terminal. A small thing, but telling. That’s how corporate ownership changes the relationship between a tool and its users.

Ben had already started building a WPackagist replacement last August, long before the acquisition made headlines. When WP Engine’s deal landed, he accelerated the launch, going live on March 16 with a fully open source repository on GitHub.

Open source repo ≠ transparent system. WP Packages makes everything public, including infrastructure and build process. – Ben Word on X

It’s also just a better tool. WP Packages supports Composer v2’s metadata-url protocol, which lets Composer fetch metadata only for the packages a project actually needs. WPackagist still relies on the older provider-includes approach, forcing Composer to download large index files before resolving dependencies. Cold dependency resolves on WP Packages are roughly 17x faster: 0.7 seconds for 10 plugins compared to 12.3 seconds on WPackagist.

WP Packages also uses CDN caching with public cache headers and serves immutable, content-addressed per-package files. Package naming is cleaner (wp-plugin/ and wp-theme/ instead of wpackagist-plugin/ and wpackagist-theme/), metadata includes plugin and theme authors, descriptions, and homepage URLs that WPackagist has been missing for years, and updates sync every five minutes rather than WPackagist’s roughly 90-minute cycle.

How to Switch

Switching from WPackagist to WP Packages requires just a few terminal commands.

1. Remove your existing WPackagist packages:

composer remove wpackagist-theme/twentytwentyfive

2. Remove the WPackagist repository and add WP Packages:

composer config --unset repositories.wpackagist && composer config repositories.wp-composer composer https://repo.wp-packages.org

3. Require packages with the new naming:

composer require wp-theme/twentytwentyfive

Alternatively, use the migration script to automatically update your composer.json:

curl -sO https://raw.githubusercontent.com/roots/wp-packages/main/scripts/migrate-from-wpackagist.sh && bash migrate-from-wpackagist.sh

Roots also provides a WP Packages Changelog Action for GitHub workflows that tracks dependency updates using the new naming format. Projects using Bedrock already ship with WP Packages configured out of the box.

Open Source Wins

The entire WP Packages project is public. The application code, documentation, and even the full Ansible deployment configuration are available on GitHub. Anyone can fork the repository and run their own WordPress Composer registry. Ben has also committed publicly that WP Packages will never use the Composer info field to push messages, ads, or upsells into developer terminals. That kind of restraint is easier to promise when a project answers to its community rather than to a corporate parent.

WP Packages is funded through GitHub Sponsors. Current sponsors include Carrot, Kinsta, WordPress.com, and Itineris. The WordPress ecosystem has always been at its strongest when the community builds the tools it needs in the open. Ben saw a gap forming months before anyone else was paying attention, built something better than what existed, and released it for everyone. No acquisition required. No boardroom decisions about availability or pricing. Just developers solving a problem for other developers and sharing the result. Open source wins.