- Update to version 2.5.2
  * Added warning when `require` auto-selects a feature branch as that is probably not desired (#11270)
  * Fixed `self.version` requirements reporting lock file integrity errors when changing branches (#11283)
  * Fixed `require` regression which broke the --fixed flag (#11247)
  * Fixed security audit reports loading when exclude/only filter rules are used on a repository (#11281)
  * Fixed autoloading regression on PHP 5.6 (#11285)
  * Fixed archive command including an existing archive into itself if run repeatedly (#11239)
  * Fixed dev package prompt in `require` not appearing in some conditions (#11287)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.5.1
  * Fixed ClassLoader regression which made it fail if serialized (e.g. within PHPUnit process isolation) (#11237)
  * Fixed preg type error in svn version guessing (#11231)

• Files Changed
• Browse Source

- Update to version 2.5.0
  * BC Warning: To prevent abuse of our includeFile() function it is now gone, it was not part of the official API but may still cause issues if some code incorrectly relied on it (#11015)
  * Improved version guessing of `require` command to use the dependency resolution result instead of using the latest available version (except if you run with --no-update) (#11160)
  * Improved version selection in `archive` command (#11230)
  * Added autocompletion of config option names in the `config` command (#11130)
  * Added support for writing [custom commands as Command classes](https://getcomposer.org/doc/articles/scripts.md#writing-custom-commands) (#11151)
  * Added hard failure when installing from a lock file which does not satisfy the composer.json requirements (#11195)
  * Added warning when the outdated command rejects a new package due to unmet platform requirements (#11113)
  * Added support for `bump` command to bump `>=x` to `>=installed-version` (#11179)
  * Added `--download-only` flag to `install` command to only download and prime the cache with the package archives (#11041)
  * Added autoconfiguration of `github-domains`/`gitlab-domains` when GitHub/GitLab credentials are configured for a custom domain (#11062)
  * Added hard failure (throw) if COMPOSER_AUTH is present and malformed JSON (#11085)
  * Added interactive prompt to `run-script` and `exec` commands if run without any argument (#11157)
  * Added interactive prompt where to store credentials when a project-local auth.json exists (#11188)
  * Fixed full disk warning to be shown when less than 100MiB is available (#11190)
  * Fixed cache keys to allow `_` to avoid conflicts between package names like `a-b` and `a_b` (#11229)
  * Fixed docker compatibility by making paths more portable even if the project is installed at `/` (#11169)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.4.4
  * Added extra debug output when a zip extraction fails while on
    GitHub Actions (#11148)
  * Fixed cache write failures when the cache dir gets removed during
    a composer run (#11076)
  * Fixed 2.4.3 regression in loading Composer on SMB/network shares
    (#11077)
  * Fixed --dry-run flag missing from bump command (#11047)
  * Fixed status command reporting differences when the source ref is
    a tag (#11155)
  * Fixed outdated command outputting legend on stdout instead of stderr
  * Fixed URL sanitizer to handle new GitHub personal access tokens
    format (#11137)
- Update to version 2.4.3
  * BC Break: The json format of audit command now has reportedAt as an
    RFC3339 string instead of an object which was a mistake (#11120)
  * Fixed json format of audit command which was missing affectedVersions
    (#11120)
  * Fixed plugin commands not being loaded during bash completions
    (#11074)
  * Fixed parsing of inline aliases within complex constraints with
    || or , (#11086)
  * Fixed min-php version check in autoload.php to avoid crashing sites
    running on PHP 5.5 or below silently with a 200 (#11091)
  * Fixed JsonFile reading files without checking if they are readable
    first (#11077)
  * Fixed require command with --dry-run failing when requiring a package
    requiring stability flag extraction (#11112)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.4.2
  * Fixed bash completion hanging when running as root without
    COMPOSER_ALLOW_SUPERUSER set (#11024)
  * Fixed handling of plugin activation when running as root without
    COMPOSER_ALLOW_SUPERUSER set so it always happens after prompting,
    or does not happen if input is non-interactive
  * Fixed package filter on bump command (#11053)
  * Fixed handling of --ignore-platform-req with upper-bound ignores
    to not apply to conflict rules (#11037)
  * Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0
  * Fixed handling of zero-major versions in outdated command with
    --major-only (#11032)
  * Fixed show --platform regression since 2.4.0 when running in a
    directory without composer.json (#11046)
  * Fixed a few strict type errors
- Update to version 2.4.1
  * Added a COMPOSER_NO_AUDIT env var to easily apply the new --no-audit
    flag in CI (#10998)
  * Fixed show command showing packages in two sections, this was only
    meant for the outdated command (#11000)
  * Fixed local git repos being copied to cache unnecessarily (#11001)
  * Fixed git cache invalidation issue when a git tag gets created after
    the cache has loaded a given reference (#11004)
- Update to version 2.4.0
  * Added bash completions for Composer commands, package names, etc
    (see how to setup) (#10320)
  * Added bump command to bump requirements to the currently installed
    version (#10829)
  * Added audit command to check for known security vulnerabilities in
    installed packages (#10798, #10898)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.3.10
  * Fixed plugins from CWD/vendor being loaded in some cases like
    create-project or validate even though the target directory is
    outside of CWD (#10935)
  * Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo)
    plugins which will not warn/error anymore if not in allow-plugins,
    as they are anyway not loaded (#10928)
  * Fixed pre-install check for allowed plugins not taking --no-plugins
    into account (#10925)
  * Fixed support for disable_functions containing disk_free_space
    (#10936)
  * Fixed RootPackageRepository usages to always clone the root package
    to avoid interoperability issues with plugins (#10940)
- Update to version  2.3.9
  * Fixed non-interactive behavior of allow-plugins to throw instead
    of continue with a warning to avoid broken installs (#10920)
  * Fixed allow-plugins BC mode to ensure old lock files created pre-2.2
    can be installed with only a warning but plugins fully loaded (#10920)
  * Fixed deprecation notice (#10921)
  * Fixed type errors (#10924)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.3.8
  * Fixed support for cache-read-only where the filesystem is not writable (#10906)
  * Fixed type error when using allow-plugins: true (#10909)
  * Fixed @putenv scripts receiving arguments passed to the command (#10846)
  * Fixed support for spaces in paths with binary proxies on Windows (#10836)
  * Fixed type error in GitDownloader if branches cannot be listed (#10888)
  * Fixed RootPackageInterface issue on PHP 5.3.3 (#10895)
  * Fixed type errors (#10904, #10897)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.3.7
  * Fixed a few PHPStan ConfigReturnTypeExtension bugs
  * Fixed Config default for auth configs to be empty arrays instead
    of null, fixes issues with diagnose command (#10814)
  * Fixed handling of broken symlinks when checking whether a package
    is still installed (#6708)
  * Fixed bin proxies to allow a proxy to include another one safely
    (#10823)
  * Fixed openssl 3.x version parsing as it is now semver compliant
  * Fixed type error when a json file cannot be read (#10818)
  * Fixed parsing of multi-line arrays in funding.yml (#10784)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.3.6
  * Added Composer\PHPStan\ConfigReturnTypeExtension to improve return
    types of Config::get() which you can also use in plugins CI (#10635)
  * Fixed name validation regex in schema causing issues with JS IDEs
    like VS Code (#10811)
  * Fixed unnecessary HTTP request in BitbucketDriver (#10729)
  * Fixed invalid credentials loop when setting up GitLab token (#10748)
  * Fixed PHP 8.2 deprecations (#10766)
  * Fixed lock file changes being output even when the lock file creation
    is disabled
  * Fixed race condition when multiple requests asking for auth on the
    same hostname fired concurrently (#10763)
  * Fixed quoting of commas on Windows (#10775)
  * Fixed issue installing path repos with a disabled symlink function
    (#10786)
  * Fixed various type errors (#10753, #10739, #10751)

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

Update to version 2.3.5 for CVE-2022-24828

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

- Update to version 2.3.3
  * Added --2.2 flag to `self-update` to pin the Composer version to
    the 2.2 LTS range (#10682)
  * Added missing config.bitbucket-oauth in composer-schema.json
  * Fixed type errors in SvnDriver (#10681)
  * Fixed --version output to match the pre-2.3 one (#10684)
  * Fixed config/auth.json files not being validated against the
    composer-schema.json (#10685)
  * Fixed generation of autoload crashing if a package has a broken
    path (#10688)
  * Fixed GitDriver state issue when reusing old cache dirs and the
    default branch was renamed (#10687)
  * Updated semver, jsonlint deps for minor fixes
  * Removed dev-master=>dev-main alias from #10372 as it does not
    work when reloading from lock file and extracting dev deps (#10651)
- Update to version 2.3.2
  * Fixed type error when running `exec` command (#10672)
  * Fixed endless loop in plugin activation prompt when input is not
    fully interactive yet appears to be (#10648)
  * Fixed type error in ComposerRepository (#10675)
  * Fixed issues loading platform packages where the version of a
    library cannot be established (#10631)
- Update to version 2.3.1
  * Fixed type error when HOME env var is not set (#10670)
- Update to version 2.3.0
  * Fixed many strict types errors (#10646, #10642, #10647, #10658,
    #10656, #10665, #10660, #10663, #10662)
  * Fixed invalid return value in ComposerRepository::findPackage
    (#10622)
  * Fixed many `show` command issues due to a flipped condition

• Files Changed
• Browse Source