-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 23 Oct 2026 11:27:46 +0200
Source: composer
Architecture: source
Version: 2.11.0~rc1-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
composer (2.11.0~rc1-1) experimental; urgency=medium
.
* Upload RC to experimental
.
[ Jordi Boggiano ]
* Add batching to the security advisories API queries for projects with very
large dep count (#13051)
* Add installed version to sub-dependencies in show --tree JSON output
(#13049)
* Load more classes pre-emptively before swapping the phar file, fixes #13079
* Warn about paths only differing in casing in optimized autoload dumps
(#13085)
* Pass along agent name as well as agent (#13087)
* Bump plugin API version to 2.11
* Remove source-fallback option that was added in 2.10 as a stop-gap measure
(#13050)
* Fix clear-cache --no-cache reporting missing dirs instead of disabled cache
(#13092)
* Retry downloads of truncated zip archives (#13094)
* Escape package controlled data interpolated into the generated bin proxies
(#13056)
* Stop requesting HTTP/3, as hosts Composer talks to do not support it yet
(#13096)
* Track why policies removed each version in one map on the pool (#13100)
* Parse package release/published dates lazily (#13103)
* Load package metadata in parallel before outdated/show --latest lookups
(#13113)
* Make outdated and show --latest respect the cooldown policy (#13102)
* Bump >=10 style lower bounds without loosening OR constraints (#13133)
* Bump minimum required justinrainbow/json-schema
* Count authentication retries separately from network retries (#13135)
* Fix repository transport options matching dist URLs on other hosts (#13142)
* Fix secure-http check skipping malformed URLs and git transport prefixes
(#13144)
* Avoid warnings when finding packages within inline packages without uid
(#13148)
* Reject TLS connections presenting distrusted intermediate certificates
(#13146)
* Make sure the policy config is reflected in the lock file (#13149)
* Add --no-cooldown flag to update/require/remove/create-project (#13153)
* Update changelog
* Release 2.11.0-RC1
.
[ Greg Roach ]
* Fix: an empty command in a script should always be a NO-OP (#13053)
.
[ Pascal CESCON ]
* Report the GitHub API rate limit when the clone fallback fails (#13059)
.
[ Markus Staab ]
* Move getVersion() call out of loop (#13123)
* RuleWatchGraph: Reduce getRule() calls (#13124)
* Solver: Call getLiterals() only for enabled rules (#13132)
.
[ Eirik Stanghelle Morland ]
* Support retrying requests honoring their retry-after header (#13082)
* Send AI agent info as part of user agent (#13073)
.
[ Nicolas Grekas ]
* Replace generated files instead of rewriting them in place (#13069)
.
[ Yanick Witschi ]
* Reuse version lists within pool optimizer package groups (#13072)
* Avoid repeated invariant constraint checks in pool optimization (#13071)
* Add terminal program status reporting via OSC (#13117)
.
[ Samran Asif ]
* Url: preserve SSH user in stripCredentials() (#13081)
.
[ Lazizbek Ergashev ]
* Skip loading security advisories for named dev branches' packages in the
pool filter (#13089)
.
[ MD Ali Kadar ]
* Share the repeated warning dedup across all outputWarnings() callers
(#13090)
.
[ Ben Younes ]
* Exclude the vendor dir from root classmap scanning (#13018)
* Fix suggest filtering for non-installed packages (#12992) (#13014)
.
[ Nicholas Ciechanowski ]
* feat: add `strict-psr-autoloader` to options (#12893)
.
[ Alessandro Lai ]
* Fix handling of GitLab CI job token auth (#12916)
.
[ Stephan ]
* Custom policies: add block-scope config option to block during composer
install (#12990)
.
[ Viktor Djupsjöbacka ]
* Add cooldown policy config to filter newly released packages (#12692)
.
[ Tony Nguyen ]
* Fail install when composer.lock has a content-hash merge conflict (#13105)
.
[ kevin ]
* Fix JsonManipulator::addSubNode modifying a nested key with the same name
(#13109)
.
[ Daler Azimov ]
* Fix wildcard package updates with --minimal-changes (#13118)
.
[ Nguyen Quang Truong ]
* Explain advisory-blocked versions in dependency conflicts (#13108)
.
[ PrinsFrank ]
* Ask user if the composer.lock should be added to .gitattributes with
export-ignore when initializing a library (#13127)
.
[ Bram Driesen ]
* feat: Add support for -D (direct) in audit command (#13121)
.
[ qodelicious ]
* Merge custom-headers from all config sources (#13141)
.
[ hershel-theodore-layton ]
* Check plugin capability correctness before instantiating it (#13139)
.
[ Daniel Pinto ]
* Treat packages with no installable version as up to date in outdated
(#13138)
.
[ Soner ]
* Add only-branches option to VCS repositories (#13086)
.
[ Adel Kaleche ]
* Explain security-blocked versions with partial advisories instead of failing
(#13075)
.
[ Maciej Pawłowski ]
* Support Bitbucket Cloud’s new SSH hostname (#13152)
.
[ David Prévot ]
* Document CVE in previous changelog entry
Checksums-Sha1:
5dacb9fe941999c5b2ef13b5eea21c5e0fae9d60 2662 composer_2.11.0~rc1-1.dsc
b62f8678faf60571a50eaff565d7a7e9882ecbb5 853232 composer_2.11.0~rc1.orig.tar.xz
bbb0c29c5cd5309f967ab6a2a9924e39aad54b27 65048 composer_2.11.0~rc1-1.debian.tar.xz
c317ebc51d5b3367015731864460ae80f01629a2 9858 composer_2.11.0~rc1-1_amd64.buildinfo
Checksums-Sha256:
91c25afba1fd80733eaf8ef083676b072ecb828afdf461789ff9c67eaba90168 2662 composer_2.11.0~rc1-1.dsc
ea3e6b949ce5fa46d44ca3d46323376ec476ed8f7ee26588639a6519ebc2c0f8 853232 composer_2.11.0~rc1.orig.tar.xz
51d134d68a91d1281bf8cb69187a9fe49e72330842eaf81c926c2910aad5216d 65048 composer_2.11.0~rc1-1.debian.tar.xz
2a8531ed593f69afee7482e8897fd59a881617a8b3fdc6ec56d1e7ad62334e17 9858 composer_2.11.0~rc1-1_amd64.buildinfo
Files:
d41f15270afa92f6ffc50baf085351f6 2662 php optional composer_2.11.0~rc1-1.dsc
dd5ef11187f0271191ab36e1303da414 853232 php optional composer_2.11.0~rc1.orig.tar.xz
642103264f81542a8a9b749b2b6e3065 65048 php optional composer_2.11.0~rc1-1.debian.tar.xz
8a3cc948c7a0f1943c131d9169358345 9858 php optional composer_2.11.0~rc1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEErhStAUJtK/uC734euCohev3+CfIFAmrbVtAACgkQuCohev3+
CfLqRw//XKS5Ucg/1UEkSpKfEQdLc7V13Ks9d3c1pNUoF7qOz05zy9akAWCfIZW4
4/6yqLy/ZIp6njGfTW/1BGILJcDalVP4hImmYn+ny3G4Dax310Yct2YYPDtiXefi
eVv8SLMUGZul4q18yUY+NZqAxf5HnWWvP7G5+Un+3MPwwt/Wnlxf9TivDRDCgBGr
UEPjHrvLgj0g1nSTrqZcz5kyHpLkJVgHZ+Ad8uQTW8YUvOp2qSspN3rJ4DkTbhVi
WG7iWV99GYPrj8s8cIUkZD/Azypboa14DiTVUwDlFpPyli3lLyr2R1io3N7c674f
93O/AN89G5CnMnvO2+fQahGuXvO3laaq9uu4GL/DRznvYDvkvx/2LgHGiCjRkqNy
ahOeE8PoezrFsmtkabDNDRgmNIIg1RJwM4XHytOPj9gIURdO0hunVMiE1xBXwaku
8Y69S1XtziUN1zPBmqvVS7qD1xWiMnUbawzpNda2M9bzOc3Zs45PouuudUBAb0j3
KYSkLT+HwW1ilRst5JJdX02rSTN4QbfG8jJxEsDXUaBtuG/TUZgEfWAZa56oNxRL
QioFI5kyGghE5CzvXqRz7L6xIaJ6Gw7waeMCOs9xLfPYuFZV+dvWxH3kslD/aMzk
WuyxfZXt7HTnZ1bHy4/MLdbCWiNJeVcSXA3+a3OrcrtffdtgM6Q=
=M+jQ
-----END PGP SIGNATURE-----
