Fedora Security Advisories

composer-2.11.1-1.fc45

Fedora Security Advisories
2 days 16 hours ago
FEDORA-2026-fdc2ab47c1 Packages in this update:
  • composer-2.11.1-1.fc45
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.el9

Fedora Security Advisories
2 days 16 hours ago
FEDORA-EPEL-2026-714697c191 Packages in this update:
  • composer-2.11.1-1.el9
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.el10_2

Fedora Security Advisories
2 days 16 hours ago
FEDORA-EPEL-2026-58e2fdc6d6 Packages in this update:
  • composer-2.11.1-1.el10_2
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.el10_4

Fedora Security Advisories
2 days 16 hours ago
FEDORA-EPEL-2026-8e8488d18d Packages in this update:
  • composer-2.11.1-1.el10_4
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.fc44

Fedora Security Advisories
2 days 16 hours ago
FEDORA-2026-0fac5fe7fe Packages in this update:
  • composer-2.11.1-1.fc44
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.el10_3

Fedora Security Advisories
2 days 16 hours ago
FEDORA-EPEL-2026-b48903dc27 Packages in this update:
  • composer-2.11.1-1.el10_3
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.1-1.fc43

Fedora Security Advisories
2 days 16 hours ago
FEDORA-2026-f2a72b9a61 Packages in this update:
  • composer-2.11.1-1.fc43
Update description: Version 2.11.1 - 2026-10-30
  • Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
  • Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
  • Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
  • Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
  • Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)
Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

fasterxml-oss-parent-69-1.fc44 jackson-annotations-2.18.12-1.fc44 jackson-bom-2.18.12-1.fc44 jackson-core-2.18.12-1.fc44 jackson-databind-2.18.12-1.fc44 jackson-jaxrs-providers-2.18.12-1.fc44 jackson-modules-base-2.18.12-1.fc44 jackson-parent-2.18.4-1…

Fedora Security Advisories
2 days 16 hours ago
FEDORA-2026-b7ad391dd5 Packages in this update:
  • fasterxml-oss-parent-69-1.fc44
  • jackson-annotations-2.18.12-1.fc44
  • jackson-bom-2.18.12-1.fc44
  • jackson-core-2.18.12-1.fc44
  • jackson-databind-2.18.12-1.fc44
  • jackson-jaxrs-providers-2.18.12-1.fc44
  • jackson-modules-base-2.18.12-1.fc44
  • jackson-parent-2.18.4-1.fc44
Update description:

Fix CVE-2026-89407 CVE-2026-89425 CVE-2026-68497 CVE-2026-68498 CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 across aligned packages updated to version 2.18.12

Checked
43 minutes 11 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security