Composer is a dependency manager tracking local dependencies of your projects
and libraries.
Provides
Requires
License
MIT
Changelog
* Fri Aug 28 2026 Petr Gajdos <pgajdos@suse.com>
- version update to 2.10.3
* Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
* Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
* Sanitize URL-embedded usernames/token in a few more places (#13044)
* Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
* Fixed PHP 8.6 deprecation warnings (#12967, #13028)
* Fixed error output when a policy blocks a package version to be clearer (#12993)
* Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
* Fixed possible race condition while creating directories like the cache dir when running multiple
Composer processes in parallel (#12977)
* Fixed forgejo support to handle empty repositories better (#12968)
* Fixed FilterListApiClient not forwarding transport options (#13040)
- fixes CVE-2026-84361 [bsc#1278257]
CVE-2026-59944 [bsc#1279898]
* Fri Jul 31 2026 Petr Gajdos <pgajdos@suse.com>
- fix a regression on s390x due last change [bsc#1271729]
- added patches
https://github.com/Seldaek/phar-utils/pull/13
* php-composer2-little-endian-no-machine-order.patch
* Wed Jul 15 2026 Petr Gajdos <pgajdos@suse.com>
- refactor packaging to use upstream sources instead of phar
- added patches
* php-composer2-compiler-env.patch
* Tue Jul 14 2026 Petr Gajdos <pgajdos@suse.com>
- version update to 2.10.2
* Validate package names (GHSA-499r-g7pc-vmp9)
* Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
* Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
* Only follow HTTP redirects from HTTP responses (#12948)
* Prevent phar metadata unserialization on unsafe PHP versions (#12946)
* Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
* Added warning output in self-update command when using a soon-to-be EOL version (#12920)
* Added download retry when a GitHub codeload URL returns a 400 (#12962)
* Fixed audit command to output the audit result to stdout (#12904)
* Fixed backspace characters being output to non-decorated output (#12925)
* Fixed security advisory blocking causing issues with xdebug enabled (#12935)
* Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
* Fixed security advisory blocking causing issues with xdebug enabled (#12935)
- version update to 2.10.1
* Fixed shell escaping when opening an editor (#12903)
* Verify backup phar signature before restoring it when using self-update --rollback (#12918)
* Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
* Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
* Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
* Fixed warnings from Composer repositories being printed twice in some cases (#12907)
* Tue Jun 02 2026 Petr Gajdos <pgajdos@suse.com>
- version update to 2.10.0
* BC Break / Security: Disabled automatic fallback to source checkout if dist/zip
install fails, we have introduced a new source-fallback config option as a temporary
way to restore the old behavior, but if you need this talk to us as we plan to remove
it entirely in 2.11 (#12885)
* BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or
1 if anything failed the audit (#12881)
* Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
* Security: Fixed handling of uppercase schemes in URL validation that might have allowed
https requirement bypass (#12884)
* Fixed audit command returning a success code when the vendor dir was not present (#12880)
- modified sources
* composer.phar
- fixes CVE-2026-45793 [bsc#1271504]
* Mon Apr 27 2026 Petr Gajdos <pgajdos@suse.com>
- version update to 2.9.7
* Fixes regression calling custom script command aliases that are called a substring
of a composer command (#12802)
- version update to 2.9.6
* Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
* Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
* Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
* Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
* Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
* Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do
not cause issues (6621d45, d836b90, 5e08c764)
* Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
* Fixed GitHub API authentication errors not being visible to the user (#12737)
* Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
* Fixed error reporting for clarity when a constraint cannot be parsed (#12743)
- version update to 2.9.5
* Added support for new pie download-url-methods (#12727)
* Fixed detection of 7z when installed as 7za on some linux systems (#12731)
* Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already
- version update 2.9.4
* Added active plugins to the diagnose command output (#12706)
* Fixed HTTP/3 causing issues with proxies (#12699)
* Fixed show command regression with long descriptions containing unicode characters (#12704)
* Fixed regression handling invalid unicode sequences in output (#12707)
* Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
* Fixed issue handling paths with = in them on Windows (#12726)
- fixes [bsc#1262254], [bsc#1262255]
- fixes CVE-2026-59948 [bsc#1271123]
CVE-2026-59947 [bsc#1271130]
CVE-2026-59946 [bsc#1271152]
* Thu Jan 15 2026 Petr Gajdos <pgajdos@suse.com>
- version update to 2.9.3
* Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
* Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected (#12677)
* Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
* Fixed client-certificate authentication implementation (#12667)
* Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
* Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
* Fixed support for SecureTransport + LibreSSL on macOS (#12615)
* Fixed display of reasons for why advisories are ignored (#12668)
* Fixed compatibility issues when git has log.showSignature enabled (#12666)
* Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
* Fixed EventDispatcher requiring a full Composer instance to function (#12629)
- fixes [bsc#1255768]
* Mon Dec 22 2025 Petr Gajdos <pgajdos@suse.com>
- version update to 2.9.2
* Added new --no-security-blocking flag to disable/configure security blocking (#12617)
* Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
* Fixed config command not being able to set the new audit settings (#12609)
* Fixed handling audit.ignore to support CVE ids while doing security blocking, but advisory IDs are still preferred for performance reasons (#12624)
* Fixed partial updates failing when another package in the lock file has a known security advisory (#12626)
- version update to 2.9.1
* Fixed regression in phpunit binary proxies (#12601)
* Fixed script handler autoloading issues (#12606)
* Fixed null call of Command::setDescription in some cases (#12605)
* Fixed --prefer-lowest builds sometimes failing due to the filtering of versions with known vulnerabilities (#12603)
- version update to 2.9.0
* Bumped composer-plugin-api to 2.9.0
* Added automatic blocking of packages with security advisories from updates (#11956)
* Added audit > block-insecure config setting to control blocking of updates to package versions with known security advisories (defaults to true) (#11956)
* Added audit > block-abandoned config setting to control blocking of updates to abandoned packages (defaults to false) (#11956)
* Added audit > ignore-abandoned config setting to ignore some packages (#12572)
* Added --ignore-unreachable flag to audit command to allow running audit in environments that do not have access to some repos (#12470)
* Added repository command to add, remove, or update repositories more easily (#12388)
* Updated repositories structure to contain a name attribute and being stored preferably as list instead of object (#12388)
* Added support for --minimal-changes full updates where only packages that need changing to satisfy modified constraints are updated (#12349)
* Added update-with-minimal-changes config setting (and COMPOSER_MINIMAL_CHANGES env var) to default to minimal changes (#12545)
* Added support for forgejo / codeberg.org repositories (#12307)
* Added automatic recovery of simple lock file conflicts when running update with a file that has a content-hash conflict (#11517)
* Added support for HTTP/3 if libcurl supports it (#12363)
* Added support for custom header authentication (#12372)
* Added support for client TLS certificates (#12406)
* Added --locked flag to licenses command to show data from the lock file instead of installed packages (#12595)
* Added SHELL_VERBOSITY env var to control verbosity of shell scripts (#12473)
* Added support for running init without interaction (#12546)
* Added COMPOSER_PREFER_DEV_OVER_PRERELEASE env var for use in development together with --prefer-lowest builds (#12585)
* Added support for Windows Sudo to elevate during self-update (#12543)
* Improved performance of script handlers by reducing ad-hoc autoloader creation (#12456)
* Fixed display of dist refs for dev versions when source is missing (#12562)
* Fixed issue not showing abandoned warnings when a package is abandoned without new release (#12423)
* Fixed compatibility issues with Symfony 7
* Fixed issues with PHP preloading being hard to debug (#12528)
- version update to 2.9.0rc1
* Bumped composer-plugin-api to 2.9.0
* Added automatic blocking of packages with security advisories from updates (#11956)
* Added audit > block-insecure config setting to control blocking of updates to package versions with known security advisories (defaults to true) (#11956)
* Added audit > block-abandoned config setting to control blocking of updates to abandoned packages (defaults to false) (#11956)
* Added audit > ignore-abandoned config setting to ignore some packages (#12572)
* Added --ignore-unreachable flag to audit command to allow running audit in environments that do not have access to some repos (#12470)
* Added repository command to add, remove, or update repositories more easily (#12388)
* Updated repositories structure to contain a name attribute and being stored preferably as list instead of object (#12388)
* Added support for --minimal-changes full updates where only packages that need changing to satisfy modified constraints are updated (#12349)
* Added update-with-minimal-changes config setting (and COMPOSER_MINIMAL_CHANGES env var) to default to minimal changes (#12545)
* Added support for forgejo / codeberg.org repositories (#12307)
* Added automatic recovery of simple lock file conflicts when running update with a file that has a content-hash conflict (#11517)
* Added support for HTTP/3 if libcurl supports it (#12363)
* Added support for custom header authentication (#12372)
* Added support for client TLS certificates (#12406)
* Added --locked flag to licenses command to show data from the lock file instead of installed packages (#12595)
* Added SHELL_VERBOSITY env var to control verbosity of shell scripts (#12473)
* Added support for running init without interaction (#12546)
* Added COMPOSER_PREFER_DEV_OVER_PRERELEASE env var for use in development together with --prefer-lowest builds (#12585)
* Added support for Windows Sudo to elevate during self-update (#12543)
* Improved performance of script handlers by reducing ad-hoc autoloader creation (#12456)
* Fixed display of dist refs for dev versions when source is missing (#12562)
* Fixed issue not showing abandoned warnings when a package is abandoned without new release (#12423)
* Fixed compatibility issues with Symfony 7
* Fixed issues with PHP preloading being hard to debug (#12528)
* Mon Oct 06 2025 Ferdinand Thiessen <rpm@fthiessen.de>
- version update to 2.8.12
* Fixed json schema issues with version validation
* Fixed support for Bitbucket API tokens
* Fixed handling of spaces in paths when using binaries
* Fixed config --global path resolution issue
* Reduced peak memory usage while loading packages
* Dropped react/promise 2.x support
- version update to 2.8.11
* Fixed bump command handling
* Fixed psr-4 warnings being shown when using symlinked directories
* Fixed audit command failing hard if any advisory constraint was invalid
- version update to 2.8.10
* Fixed plugins appearing loaded despite not being loaded yet
* Fixed forward compatibility with Symfony 7.4
* Fixed deprecation warning on PHP 8.4 when platform check fails
* Fixed json schema issues with version validation
* Wed Jul 02 2025 pgajdos@suse.com
- version update to 2.8.9
* Fixed json schema issues with version validation (#12376)
* Fixed bump-after-update triggering after an update --lock, which makes no sense (#12371)
* Fixed zip bomb false positives when unpacking using ZipArchive (#12409)
* Fixed creation of empty archives (#12408)
* Removed output of script being run when running via composer <script-name> (#12383)
- modified sources
% composer.phar
* Tue Apr 22 2025 pgajdos@suse.com
- fix keyring (https://github.com/composer/composer/issues/12009)
- modified sources
% php-composer2.keyring
* Thu Apr 17 2025 Ferdinand Thiessen <rpm@fthiessen.de>
- Update to version 2.8.8
- Fixed json schema issues with version validation
- Fixed issues running on 32bit machines
- Update to version 2.8.7
- Added COMPOSER_MAX_PARALLEL_PROCESS env var to control max amount of parallel processes Composer will start
- Added zstd/brotli presence in diagnose command output
- Fixed error handler to avoid spamming deprecation notices
- Fixed InstalledVersions returning duplicate data at Composer runtime
- Fixed handling of --with ... constraints to make them apply to packages replaced a package with a different name
- Fixed deprecation warnings showing up in IDE code inspections within the vendor dir
- Fixed a few json schema completeness issues
- Fixed issue autoloading files with a .phar inside the path
- Update to version 2.8.6
- Added COMPOSER_WITH_DEPENDENCIES and COMPOSER_WITH_ALL_DEPENDENCIES env vars to enable the --with[-all]-dependencies flags
- Added COMPOSER_SKIP_SCRIPTS env var to tell Composer to skip certain script handlers by script names (comma separated)
- Fixed handling of backslash in folder names when creating archives
- Fixed detection of containerd for containers to avoid warning about root usage
- Update to version 2.8.5
- Fixed InstalledVersions regression from 2.8.4 when reload() is used
- Fixed psr-0/psr-4 rules having unstable order in vendor/composer/autoload*.php
- Fixed a few warnings happening incorrectly in edge cases
- Update to version 2.8.4
- Fixed exit code of the audit command not being meaningful (now 1 for vulnerabilities and 2 for abandoned, 3 for both)
- Fixed issue on plugin upgrade when it defines multiple classes
- Fixed duplicate errors appearing in the output depending on php settings
- Fixed InstalledVersions returning duplicate data in some instances
- Fixed installed.php sorting to be deterministic
- Fixed bump-after-update failing when using inline constraints
- Fixed create-project command to now disable symlinking when used with a path repo