-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 23 Oct 2026 11:27:46 +0200 Source: composer Architecture: source Version: 2.11.0~rc1-1 Distribution: experimental Urgency: medium Maintainer: Debian PHP PEAR Maintainers <[email protected]> Changed-By: David Prévot <[email protected]> Changes: composer (2.11.0~rc1-1) experimental; urgency=medium . * Upload RC to experimental . [ Jordi Boggiano ] * Add batching to the security advisories API queries for projects with very large dep count (#13051) * Add installed version to sub-dependencies in show --tree JSON output (#13049) * Load more classes pre-emptively before swapping the phar file, fixes #13079 * Warn about paths only differing in casing in optimized autoload dumps (#13085) * Pass along agent name as well as agent (#13087) * Bump plugin API version to 2.11 * Remove source-fallback option that was added in 2.10 as a stop-gap measure (#13050) * Fix clear-cache --no-cache reporting missing dirs instead of disabled cache (#13092) * Retry downloads of truncated zip archives (#13094) * Escape package controlled data interpolated into the generated bin proxies (#13056) * Stop requesting HTTP/3, as hosts Composer talks to do not support it yet (#13096) * Track why policies removed each version in one map on the pool (#13100) * Parse package release/published dates lazily (#13103) * Load package metadata in parallel before outdated/show --latest lookups (#13113) * Make outdated and show --latest respect the cooldown policy (#13102) * Bump >=10 style lower bounds without loosening OR constraints (#13133) * Bump minimum required justinrainbow/json-schema * Count authentication retries separately from network retries (#13135) * Fix repository transport options matching dist URLs on other hosts (#13142) * Fix secure-http check skipping malformed URLs and git transport prefixes (#13144) * Avoid warnings when finding packages within inline packages without uid (#13148) * Reject TLS connections presenting distrusted intermediate certificates (#13146) * Make sure the policy config is reflected in the lock file (#13149) * Add --no-cooldown flag to update/require/remove/create-project (#13153) * Update changelog * Release 2.11.0-RC1 . [ Greg Roach ] * Fix: an empty command in a script should always be a NO-OP (#13053) . [ Pascal CESCON ] * Report the GitHub API rate limit when the clone fallback fails (#13059) . [ Markus Staab ] * Move getVersion() call out of loop (#13123) * RuleWatchGraph: Reduce getRule() calls (#13124) * Solver: Call getLiterals() only for enabled rules (#13132) . [ Eirik Stanghelle Morland ] * Support retrying requests honoring their retry-after header (#13082) * Send AI agent info as part of user agent (#13073) . [ Nicolas Grekas ] * Replace generated files instead of rewriting them in place (#13069) . [ Yanick Witschi ] * Reuse version lists within pool optimizer package groups (#13072) * Avoid repeated invariant constraint checks in pool optimization (#13071) * Add terminal program status reporting via OSC (#13117) . [ Samran Asif ] * Url: preserve SSH user in stripCredentials() (#13081) . [ Lazizbek Ergashev ] * Skip loading security advisories for named dev branches' packages in the pool filter (#13089) . [ MD Ali Kadar ] * Share the repeated warning dedup across all outputWarnings() callers (#13090) . [ Ben Younes ] * Exclude the vendor dir from root classmap scanning (#13018) * Fix suggest filtering for non-installed packages (#12992) (#13014) . [ Nicholas Ciechanowski ] * feat: add `strict-psr-autoloader` to options (#12893) . [ Alessandro Lai ] * Fix handling of GitLab CI job token auth (#12916) . [ Stephan ] * Custom policies: add block-scope config option to block during composer install (#12990) . [ Viktor Djupsjöbacka ] * Add cooldown policy config to filter newly released packages (#12692) . [ Tony Nguyen ] * Fail install when composer.lock has a content-hash merge conflict (#13105) . [ kevin ] * Fix JsonManipulator::addSubNode modifying a nested key with the same name (#13109) . [ Daler Azimov ] * Fix wildcard package updates with --minimal-changes (#13118) . [ Nguyen Quang Truong ] * Explain advisory-blocked versions in dependency conflicts (#13108) . [ PrinsFrank ] * Ask user if the composer.lock should be added to .gitattributes with export-ignore when initializing a library (#13127) . [ Bram Driesen ] * feat: Add support for -D (direct) in audit command (#13121) . [ qodelicious ] * Merge custom-headers from all config sources (#13141) . [ hershel-theodore-layton ] * Check plugin capability correctness before instantiating it (#13139) . [ Daniel Pinto ] * Treat packages with no installable version as up to date in outdated (#13138) . [ Soner ] * Add only-branches option to VCS repositories (#13086) . [ Adel Kaleche ] * Explain security-blocked versions with partial advisories instead of failing (#13075) . [ Maciej Pawłowski ] * Support Bitbucket Cloud’s new SSH hostname (#13152) . [ David Prévot ] * Document CVE in previous changelog entry Checksums-Sha1: 5dacb9fe941999c5b2ef13b5eea21c5e0fae9d60 2662 composer_2.11.0~rc1-1.dsc b62f8678faf60571a50eaff565d7a7e9882ecbb5 853232 composer_2.11.0~rc1.orig.tar.xz bbb0c29c5cd5309f967ab6a2a9924e39aad54b27 65048 composer_2.11.0~rc1-1.debian.tar.xz c317ebc51d5b3367015731864460ae80f01629a2 9858 composer_2.11.0~rc1-1_amd64.buildinfo Checksums-Sha256: 91c25afba1fd80733eaf8ef083676b072ecb828afdf461789ff9c67eaba90168 2662 composer_2.11.0~rc1-1.dsc ea3e6b949ce5fa46d44ca3d46323376ec476ed8f7ee26588639a6519ebc2c0f8 853232 composer_2.11.0~rc1.orig.tar.xz 51d134d68a91d1281bf8cb69187a9fe49e72330842eaf81c926c2910aad5216d 65048 composer_2.11.0~rc1-1.debian.tar.xz 2a8531ed593f69afee7482e8897fd59a881617a8b3fdc6ec56d1e7ad62334e17 9858 composer_2.11.0~rc1-1_amd64.buildinfo Files: d41f15270afa92f6ffc50baf085351f6 2662 php optional composer_2.11.0~rc1-1.dsc dd5ef11187f0271191ab36e1303da414 853232 php optional composer_2.11.0~rc1.orig.tar.xz 642103264f81542a8a9b749b2b6e3065 65048 php optional composer_2.11.0~rc1-1.debian.tar.xz 8a3cc948c7a0f1943c131d9169358345 9858 php optional composer_2.11.0~rc1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEErhStAUJtK/uC734euCohev3+CfIFAmrbVtAACgkQuCohev3+ CfLqRw//XKS5Ucg/1UEkSpKfEQdLc7V13Ks9d3c1pNUoF7qOz05zy9akAWCfIZW4 4/6yqLy/ZIp6njGfTW/1BGILJcDalVP4hImmYn+ny3G4Dax310Yct2YYPDtiXefi eVv8SLMUGZul4q18yUY+NZqAxf5HnWWvP7G5+Un+3MPwwt/Wnlxf9TivDRDCgBGr UEPjHrvLgj0g1nSTrqZcz5kyHpLkJVgHZ+Ad8uQTW8YUvOp2qSspN3rJ4DkTbhVi WG7iWV99GYPrj8s8cIUkZD/Azypboa14DiTVUwDlFpPyli3lLyr2R1io3N7c674f 93O/AN89G5CnMnvO2+fQahGuXvO3laaq9uu4GL/DRznvYDvkvx/2LgHGiCjRkqNy ahOeE8PoezrFsmtkabDNDRgmNIIg1RJwM4XHytOPj9gIURdO0hunVMiE1xBXwaku 8Y69S1XtziUN1zPBmqvVS7qD1xWiMnUbawzpNda2M9bzOc3Zs45PouuudUBAb0j3 KYSkLT+HwW1ilRst5JJdX02rSTN4QbfG8jJxEsDXUaBtuG/TUZgEfWAZa56oNxRL QioFI5kyGghE5CzvXqRz7L6xIaJ6Gw7waeMCOs9xLfPYuFZV+dvWxH3kslD/aMzk WuyxfZXt7HTnZ1bHy4/MLdbCWiNJeVcSXA3+a3OrcrtffdtgM6Q= =M+jQ -----END PGP SIGNATURE-----
pgp7DVKZxxeBK.pgp
Description: PGP signature
