Composer 2.10.3 is a security release published on August 27, signed by maintainer Jordi Boggiano.

The update closes four vulnerabilities. Package binary paths are now validated against path traversal attacks using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944). A command injection flaw via malicious Perforce URLs has been fixed (GHSA-rvx4-ffvw-m9q3). Usernames and tokens embedded in URLs are now sanitized in additional places (#13044), and GitLab URL matching was corrected to prevent credentials leaking to the wrong domain (#12988).

On the bugfix side, the release removes PHP 8.6 deprecation warnings (#12967, #13028). Error output is clearer when a policy blocks a package version (#12993). A lock file content-hash issue involving a conflict marker that broke at runtime is fixed (#13048), as is a race condition when parallel Composer processes create directories like the cache dir (#12977). Forgejo support now handles empty repositories better (#12968), and FilterListApiClient correctly forwards transport options (#13040).

The full changelog covers 2.10.2 through 2.10.3. Given the security fixes, updating promptly is recommended.