Composer 2.10.2 Security Release!

Security release!

  • Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
  • Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
  • Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
  • Security: Only follow HTTP redirects from HTTP responses (#12948)
  • Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
  • Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)

Our Supporters

Simplify your web
Jet Brains
Joomdonation
OCH
AM Graphix
Bear

Sorry, this website uses features that your browser doesn't support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you'll be all set.