FEDORA-EPEL-2026-714697c191
Packages in this update:
Update description:
Version 2.11.1 - 2026-10-30
- Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
- Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
- Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
- Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
- Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
- Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
- Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
- Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
- Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
- Security: Fixed svn passwords not being redacted from debug output (#13171)
- Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
- Improved dependency resolution performance and memory usage (#13174)
- Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
- Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
- Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)
