Composer 2.11.0-RC1 was published on 22 October as a pre-release. The tag is signed by Seldaek, Jordi Boggiano, and points to commit 31eb692. The maintainers are asking users to test it and report regressions with stack traces and reproducible cases. The changes cover the range from Composer 2.10.3 to 2.11.0-RC1.

composer self-update --preview
composer self-update --stable

The temporary source-fallback configuration introduced in 2.10 has been removed. Dist installs no longer switch to source automatically. The composer-plugin-api requirement is now 2.11.0.

The release rejects TLS connections with distrusted intermediate certificates, including the compromised eMudhra certificates, even when the system trust store accepts their root certificates. Bin proxies no longer embed package-controlled paths or shebangs without escaping. Bin paths containing shell metacharacters are rejected. The secure-http check now handles malformed insecure URLs and Git transport syntax. Custom repository headers are no longer sent to dist URLs on other hosts whose names merely begin with the repository host name.

Composer can now hold back newly released package versions for a configurable cooldown period. This is intended to reduce exposure to compromised releases. Custom policies gain a block-scope option that can apply during installation. Terminal progress and status messages can use OSC 7501 and OSC 9 escape sequences, controlled by COMPOSER_TERMINAL_STATUS.

The audit command adds --direct, also available as -D, to inspect only direct dependencies. Composer supports Bitbucket Cloud's new ssh.bitbucket.org host, which is now used for SSH fallback. A strict-psr-autoloader configuration option mirrors the existing --strict-psr-autoloader flag. Optimized autoload dumps warn when paths differ only in letter casing.

VCS repositories can use only-branches to limit loaded branches. show --tree --format=json now includes installed versions for sub-dependencies. Security advisory requests are batched for projects with very large dependency graphs. Composer handles HTTP 429 responses and Retry-After headers by waiting and retrying. Its User-Agent now identifies AI coding agents. When creating a library with init, Composer asks whether composer.lock should receive export-ignore in .gitattributes.

Dependency resolution received performance and memory improvements. Composer no longer requests HTTP/3, avoiding a delay with recent curl versions. outdated and show --latest load package metadata in parallel. Dependency conflict messages give clearer explanations when security advisories block versions.

The release fixes outdated lock-file detection after policy configuration changes. Installation now stops cleanly when composer.lock contains a content-hash merge conflict. Truncated ZIP downloads are retried and are not cached. Generated files such as the autoloader and composer.json are replaced atomically, which avoids problems with hard links and concurrent readers.

SSH URLs retain their user name in Git commands, fixing authentication failures introduced in 2.10.3. GitLab CI job-token authentication is corrected. Custom headers from project auth.json files and COMPOSER_AUTH are merged with global headers instead of replacing them. Parallel requests retry with credentials obtained by another request instead of immediately reporting invalid credentials.

Composer now reports GitHub API rate limits when clone fallback fails. outdated no longer marks packages without an installable version as outdated. update --minimal-changes handles wildcard package names. bump preserves >=10-style constraints and no longer loosens OR constraints. Security advisories no longer apply incorrectly to named development branches such as dev-main.

The vendor directory is excluded from root classmap scanning in cases where it was previously included. self-update no longer fails with a class-not-found error while replacing the PHAR. clear-cache --no-cache now reports that caching is disabled instead of reporting missing directories. Empty script commands are treated as no-ops.

suggests now reports an error when filtering for a package that is not installed or excluded by --no-dev. JsonManipulator::addSubNode() no longer changes a nested key with the same name. Repository warnings are not printed repeatedly. Plugin capability classes are instantiated only after their interfaces have been checked. Composer no longer warns when locating inline packages without a UID.