-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 04 Jul 2026 20:10:04 +0200 Source: composer Architecture: source Version: 2.10.2-1 Distribution: unstable Urgency: medium Maintainer: Debian PHP PEAR Maintainers <[email protected]> Changed-By: David Prévot <[email protected]> Changes: composer (2.10.2-1) unstable; urgency=medium . [ Jordi Boggiano ] * Avoid deeply nested multi constraints when matching security advisories / malware (#12935) * Add warnings in self-update when using soon to be deprecated versions, or when the php version is outdated (#12920) * Only follow http(s) redirects in HTTP transports (#12947) * Prevent phar metadata unserialization on unsafe php versions (#12945) * Sanitize JSON parse errors in Http\Response to avoid leaking response bodies (#12960) * Validate resolved packages before locking (GHSA-499r-g7pc-vmp9) * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx) * Sanitize URL-embedded usernames/tokens in verbose output (GHSA-g6xq-892h-64w3) * Release 2.10.2 . [ Eyüp Can Akman ] * Avoid writing backspaces to non-decorated output (#12925) * Don't hide a suggestion provided by the suggesting package itself (#12933) . [ Keerthana ] * Fix audit output to use stdout for summary messages (#12904) . [ Dimas Febri ] * Retry downloads failing with HTTP 400 on a fresh connection (#12962) . [ David Prévot ] * Use relative path in autoload.php * Use build/vendor instead of vendor for homemade autoload.php Checksums-Sha1: a740a99e8bbd44e31c29ded545e3bee393f08aba 2306 composer_2.10.2-1.dsc 6d9a3624355472417027884b989d2507e53a337a 778404 composer_2.10.2.orig.tar.xz 0f7506de1fb31235bdbc4e4c7cf1585097f82281 58452 composer_2.10.2-1.debian.tar.xz 2546ba84825d33fcc0c17ce80db1cfa1d1f54f31 9703 composer_2.10.2-1_amd64.buildinfo Checksums-Sha256: 0c575e8ce2e49bf8b95df81b8aca6aaff9de65fb0e942ee1089ffff407f1b00a 2306 composer_2.10.2-1.dsc 8aa5413fa8c6a93f0d998a2496dc8e7275d91cf7186c84a4689508e1be09ffff 778404 composer_2.10.2.orig.tar.xz 2f8706c9680ad6d226ed62ba921a7d7f9130ae1d5f67062c66f568d48efeb878 58452 composer_2.10.2-1.debian.tar.xz caa5ea1e30882f543ec7cd666a3569724d76421d60234577a5887a1094f7a5cf 9703 composer_2.10.2-1_amd64.buildinfo Files: f58598674cb75712bb97d35f2751129e 2306 php optional composer_2.10.2-1.dsc 9f25efa4dc9224d373687f0da91272b2 778404 php optional composer_2.10.2.orig.tar.xz 2328c6840e83b55b17a1d3024f4b7b68 58452 php optional composer_2.10.2-1.debian.tar.xz b9c2e42d0279ee85293ef8611e548e96 9703 php optional composer_2.10.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmpJ9+USHHRhZmZpdEBk ZWJpYW4ub3JnAAoJEAWMHPlE9r08fe8H/j8AlYcgT5llpIZDVOFn/1+jOK9HFvSo 4ADDOZocm20VceQy5YzVmrIvWQWQicE3hcFNiZjk8dtlVFefzQ5FnJqVxxTi0WFP jZJAdnglxIsal+NlHlEvP/eOC1Tk0CWfKTxVt59Dl+DEXCwpzFG3uLiTz+GZPkAL zvIsad39u9ueeYMalLqXQlZohFe+4+wrak+i3qkCJjCAxTOjD4PP0ETCDbn+WCVK s6tVnIs+v2M3tdO/nKOU0LaxhoP4TSZHqYumlsizIMee/YqEgidqTs+g9PS+QSZS i57uCOMaqEL3xQyOxlzEGJAAUalx5ZCMlinlEvC+f9u2BY8RkceKErU= =lgst -----END PGP SIGNATURE-----
pgpeda8gAL1Qt.pgp
Description: PGP signature
