Download Latest Version 2.11.0 source code.zip (857.4 kB) Google Add to Preferred Sources
Home / 2.2.31
Name Modified Size InfoDownloads / Week
Parent folder
composer.phar 2026-10-29 2.4 MB
0
composer.phar.asc 2026-10-29 589 Bytes
0
2.2.31 source code.tar.gz 2026-10-29 578.8 kB
0
2.2.31 source code.zip 2026-10-29 803.1 kB
0
README.md 2026-10-29 1.3 kB
0
Totals: 5 Items   3.8 MB 0
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Reject TLS connections presenting distrusted intermediate certificates, composer/ca-bundle 1.4.16+ is now required (#13147)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13170)
  • Security: Fixed repository transport options such as custom http headers being sent to dist URLs on other hosts whose name starts with the repository host (#13143)
  • Security: Fixed secure-http check skipping malformed URLs and git transport-prefixed URLs (#13145)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13173)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13170)
  • Fixed warnings when finding packages within inline packages of a composer repository (#13134)
  • Fixed composer archive failing on PHP 5.3 (#13160)

Full Changelog: https://github.com/composer/composer/compare/2.2.30...2.2.31

Source: README.md, updated 2026-10-29