Bump composer/composer from 2.1.8 to 2.1.13

[dependabot]

Bumps composer/composer from 2.1.8 to 2.1.13.

Release notes

Sourced from composer/composer's releases.

2.1.12

• Fixed issues in proxied binary files relying on __FILE__ / __DIR__ on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

2.1.11

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

2.1.10

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

2.1.9

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

Changelog

Sourced from composer/composer's changelog.

[2.1.13] 2021-11-30

• Removed symfony/console ^6 support as we cannot be compatible until Composer 2.3.0 is released. If you have issues with Composer required as a dependency + Symfony make sure you stay on Symfony 5.4 for now. (#10321)

[2.1.12] 2021-11-09

• Fixed issues in proxied binary files relying on FILE / DIR on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

[2.1.11] 2021-11-02

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

[2.1.10] 2021-10-29

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

[2.1.9] 2021-10-05

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

Commits

• 1b83386 Release 2.1.13
• 0ec0f20 Update changelog
• 965b12c Allow alpha and above for latest deps build to catch dependency problems earl...
• 42c2108 Remove symfony/console ^6 compat as it is incorrect, fixes #10321
• 8a63018 Update changelog
• 28c3412 Fix php proxies to resolve FILE and DIR using realpath on PHP <8, fix...
• 3bb78fd Make new phar filename random to avoid possible concurrency issues, refs #10252
• 6a7264f Trigger autoloading of a few classes before executing self-update command, fi...
• abf832a Update what GitHub token scope is needed and what it implies (#10257)
• 4c9e567 Provide different URL options to encourage users to create low-privilege GitH...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.