Summary

Deleting a team also deleted its Composer authentication tokens, but a token that had been used in the 14 days before the team was deleted could keep downloading the team's packages for up to 14 days after the deletion. When a synchronized team was deleted on GitHub, the team's authentication tokens and members could keep downloading the team's packages until a later change in the organization made Private Packagist recalculate the access of all its members and tokens. A member removed from a synchronized team on GitHub also kept the team's access to packages in the suborganizations the team had been added to, until the next automatic synchronization of the organization, by default within 20 hours.

Who was affected

Organizations on Private Packagist Cloud until the fix on October 15, 2026, and on Private Packagist Self-Hosted installations running a version before 2.0.38, in three cases.

A team deleted in Private Packagist, if all of the following are true:

• The team had read-only or update authentication tokens.
• One of these tokens had been used with Composer in the 14 days before the deletion.

Only users with a copy of such a token could have used the remaining access, for up to 14 days after the deletion.

A team deleted on GitHub, if all of the following are true:

• The team was synchronized from GitHub or GitHub Enterprise Server and was deleted on GitHub.
• A member or a token of the team had used Composer before the deletion.

Only members of the deleted team and users with a copy of one of its tokens could have used the remaining access, until a later change in the organization made Private Packagist recalculate the access of all its members and tokens.

A member removed from a team on GitHub, if all of the following are true:

• The organization uses suborganizations, and the team, synchronized from GitHub or GitHub Enterprise Server, had been added to one or more of them.
• The member did not get access to the same packages in those suborganizations through another team.

Only the removed member could have used the remaining access, and only in those suborganizations, until the next automatic synchronization of the organization, by default within 20 hours.

Deleting a single token under Settings > Authentication tokens was not affected and stopped the token from working right away.

Impact

A user with a copy of a token of a team deleted in Private Packagist could have kept downloading the packages the deleted team had access to, for up to 14 days after the team was deleted. The token kept the access level it had, read-only or update. The token could not be used to access the API or the web interface, other teams' packages or other organizations, and could not change any data.

A member of a team deleted on GitHub could have kept downloading the packages the deleted team had access to with their own Composer credentials, even if no other team gave them access to these packages, and a user with a copy of one of the team's tokens could have done the same with the token's access level. This access lasted until a later change in the organization made Private Packagist recalculate the access of all its members and tokens, for example a synchronization that changed teams, members or repositories, or a change to the packages of a team. The member kept no access beyond what the deleted team had given them.

A member removed from a synchronized team on GitHub could have kept downloading the packages the team gave them in the suborganizations the team had been added to, with their own Composer credentials, and was still listed as a member of the team there. The member lost the team's access in the main organization right away and kept no access beyond what the team had given them in the suborganizations. The next automatic synchronization of the organization, by default within 20 hours, removed the member from the team in the suborganizations, which ended this access.

What we did

Deleting a team now stops its authentication tokens from working right away, the same way deleting a single token does. When a team is deleted on GitHub, its tokens and members now lose access to the team's packages right away. When a member is removed from a team on GitHub, Private Packagist now also removes them from the team in every suborganization the team was added to, and they lose access to its packages there right away.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

All security advisories