-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 27 Aug 2026 21:09:25 +0200
Source: composer
Architecture: source
Version: 2.10.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
composer (2.10.3-1) unstable; urgency=medium
.
[ Jordi Boggiano ]
* Fix forgejo driver to handle empty repos better (#12968)
* Mask URL credentials anywhere in a string, not just at its start (#13044)
* Update changelog
* Release 2.10.3
+ Security: Validate package bin paths against path traversal
using symlinks (GHSA-96h3-5x6v-m776) [CVE-2026-59944]
+ Security: Fixed command injection via malicious Perforce url
(GHSA-rvx4-ffvw-m9q3)
.
[ Brad Jorsch ]
* Avoid a race condition in `ensureDirectoryExists` (#12977)
.
[ Stephan ]
* Policies: show which source blocked a package version as part of
the filter list pool filter (#12993)
.
[ Lazizbek Ergashev ]
* Replace deprecated spl_object_hash with spl_object_id, fixes #13027 (#13028)
.
[ Eyüp Can Akman ]
* Fix `Url::getOrigin` prefix-matching a host against `gitlab-domains`
(#12988)
.
[ Pascal CESCON ]
* Do not use a conflicted content-hash as the autoloader suffix (#13048)
.
[ Eirik Stanghelle Morland ]
* Make it possible to pass transport options to FilterListApiClient (#13040)
.
[ David Prévot ]
* Use debhelper-compat 14
Checksums-Sha1:
63d14b1d4e017f4548f0b4242d8ac724dbeeed56 2306 composer_2.10.3-1.dsc
509038ed8b4fa54c9b1deb64913d8a1fb51a6e34 783440 composer_2.10.3.orig.tar.xz
348804859678822ab6eba04b5c610475f90a8ddf 59224 composer_2.10.3-1.debian.tar.xz
fa77475d51a897c57da309c82f9b795fb39fc7c4 9398 composer_2.10.3-1_amd64.buildinfo
Checksums-Sha256:
304d9c8cc5816f35b48c8d7b74c9130d7ef8c0225c25e23ebaf8a153083d7ae3 2306 composer_2.10.3-1.dsc
1070c39f13e4cb354fee3786e9d29cde351f5caaf50d4fabf98cfd7797c0939e 783440 composer_2.10.3.orig.tar.xz
ef82307e2f7da7d0ea997da929d4a6b709e56436e652a160e0d7512fce32aef3 59224 composer_2.10.3-1.debian.tar.xz
cd03ecbfb08a0ea97270bd998e6b445f2ae97f06fbc50025608ec57f4e582218 9398 composer_2.10.3-1_amd64.buildinfo
Files:
be7e933819602edc5a8e25a1c0edadad 2306 php optional composer_2.10.3-1.dsc
ac08fc30e007f9ca07dd15e6022641bf 783440 php optional composer_2.10.3.orig.tar.xz
774c9e39db7bee02475f42bebc34208e 59224 php optional composer_2.10.3-1.debian.tar.xz
efef45e2cb38ecf8ef3a134a7e8e1719 9398 php optional composer_2.10.3-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmqRNNkSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08cEMH+waru05zeanpiiDO+R7ijX+muYBmgfuW
kzgmjSI95F2LlcKe5rf2fnVF3xs3HNYC76XdkIAq4bNooKyLC2JkR5BxfgH3Lzk0
0tKPBgTODVuMtQthBJDVx1byljox+rPjQu6IMSmbpoud9G/6lgSP5VAtqnIjHRL5
pOxYWwCVUmwRIx5qpe8KGgcFbZWXDW/KWgDC0V5+4smnz2Kj3uUcEQd4dcmS7TU0
X+W/8RH1ZGFwGz3SV1XzKkWQg3dMVMdphlstne2Fn9yp1Biho/S/zBKM7KsXmRhS
SS73HT78hEw9bXcz42OKuWi50hT6zSx9oPTKe7AVA9fvWaWo9517Qjc=
=56K5
-----END PGP SIGNATURE-----
