Composer 2.10.3 Closes Four Security Holes
Composer 2.10.3 patches four security issues, including symlink-based path traversal in package binaries and command injection via malicious Perforce URLs.
The release also fixes PHP 8.6 deprecations and several bugs. Update promptly.
Composer 2.10.3 is a security release published on August 27, signed by maintainer Jordi Boggiano.
The update closes four vulnerabilities. Package binary paths are now validated against path traversal attacks using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944). A command injection flaw via malicious Perforce URLs has been fixed (GHSA-rvx4-ffvw-m9q3). Usernames and tokens embedded in URLs are now sanitized in additional places (#13044), and GitLab URL matching was corrected to prevent credentials leaking to the wrong domain (#12988).
On the bugfix side, the release removes PHP 8.6 deprecation warnings (#12967, #13028). Error output is clearer when a policy blocks a package version (#12993). A lock file content-hash issue involving a conflict marker that broke at runtime is fixed (#13048), as is a race condition when parallel Composer processes create directories like the cache dir (#12977). Forgejo support now handles empty repositories better (#12968), and FilterListApiClient correctly forwards transport options (#13040).
The full changelog covers 2.10.2 through 2.10.3. Given the security fixes, updating promptly is recommended.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.