Composer 2.2.30 fixes four security vulnerabilities
Composer 2.2.30 is a security release for the 2.2 LTS line.
It patches a path traversal issue via package bin symlinks (CVE-2026-59944), a command injection through malicious Perforce URLs, and two credential-leak fixes involving URL-embedded tokens and GitLab URL matching.
Composer 2.2.30 is a security-only release for the 2.2 LTS branch, published on 27 August by Jordi Boggiano (Seldaek). The tag is signed and the release is marked immutable.
Four vulnerabilities are addressed. First, package bin paths are now validated against path traversal attacks that use symlinks, tracked as GHSA-96h3-5x6v-m776 and CVE-2026-59944. Second, a command injection via a malicious Perforce URL was fixed (GHSA-rvx4-ffvw-m9q3).
Two further fixes concern credential handling. URL-embedded usernames and tokens are now sanitized in additional places (PR #13045), and the matching of GitLab URLs was corrected so credentials cannot leak to the wrong domain (PR #13042).
Users still on the 2.2 line should update promptly. The full changelog covers 2.2.29 to 2.2.30.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.