Aggregator | Linuxlookup

Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

Version 2.11.0 - 2026-10-29

Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
Security: Fixed svn passwords not being redacted from debug output (#13171)
Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
Improved dependency resolution performance and memory usage (#13174)
Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

4 days 14 hours ago

FEDORA-EPEL-2026-714697c191 Packages in this update:

Update description: Version 2.11.1 - 2026-10-30

Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

Version 2.11.0 - 2026-10-29

Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
Security: Fixed svn passwords not being redacted from debug output (#13171)
Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
Improved dependency resolution performance and memory usage (#13174)
Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)