2.11.0

Read the Composer 2.11 Release Announcement for more details on the release highlights.

Full Changelog

• BC Break: Removed the source-fallback config option which was added in 2.10 as a temporary measure, dist installs no longer fall back to source (#13050)
• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Security: Reject TLS connections presenting distrusted intermediate certificates (the compromised eMudhra ones) even if the system CA store trusts their roots (#13146)
• Security: Fixed bin proxies embedding package-controlled bin paths and shebangs unescaped, and bin paths containing shell metacharacters are now rejected (#13056)
• Security: Fixed secure-http not catching insecure URLs that are not strictly valid or use git's <transport>::<address> syntax (#13144)
• Security: Fixed repository options like custom http headers being sent along to dist URLs on other hosts whose name starts with the repository host (#13142)
• Bumped composer-plugin-api to 2.11.0
• Added a cooldown policy to withhold newly released package versions for a configurable period, reducing exposure to compromised releases (#12692, #13098, #13099, #13100, #13102, #13153)
• Added block-scope option to custom policies so they can also block during install (#12990)
• Added terminal progress/status reporting via OSC 7501 and OSC 9 escape sequences, which can be configured with COMPOSER_TERMINAL_STATUS (#13117)
• Added --direct (-D) option to audit to only audit direct dependencies (#13121)
• Added support for Bitbucket Cloud's new ssh.bitbucket.org SSH hostname, which is also used for the SSH fallback now (#13152)
• Added strict-psr-autoloader config option, the equivalent of the --strict-psr-autoloader flag (#12893)
• Added a warning when an optimized autoload dump contains paths only differing in casing (#13085)
• Added only-branches option to VCS repositories to restrict which branches are loaded (#13086)
• Added installed versions of sub-dependencies in show --tree --format=json output (#13049)
• Added batching of security advisory API queries for projects with a very large number of dependencies (#13051)
• Added support for 429 responses and Retry-After headers, Composer now waits and retries when a repository asks for it (#13082)
• Added AI coding agent to the User-Agent (#13073, #13087)
• Added a prompt in init to add composer.lock to .gitattributes with export-ignore when creating a library (#13127)
• Improved dependency resolution performance and memory usage (#13071, #13072, #13103, #13123, #13124, #13132, #13174)
• Improved performance by not requesting HTTP/3 anymore, which added a delay on every new connection with recent curl versions (#13096)
• Improved performance of outdated and show --latest by loading package metadata in parallel (#13113)
• Improved explanations for versions blocked by security advisories in dependency conflict errors (#13108, #13075)
• Fixed the lock file not being flagged as outdated when the policy config changes - this will trigger a lock file change warning if you have a policy config defined (#13149)
• Fixed install to fail when composer.lock has a content-hash merge conflict (#13105)
• Fixed truncated zip downloads failing at extraction, they are now retried and never cached (#13094)
• Fixed generated files (autoloader, composer.json, ...) being rewritten in place, which affected hardlinked copies and concurrent readers (#13069)
• Fixed SSH URLs losing their user in git commands, causing auth failures since 2.10.3 (#13081)
• Fixed GitLab CI job token authentication (#12916)
• Fixed custom-headers from a project auth.json or COMPOSER_AUTH replacing the global ones instead of being merged (#13141)
• Fixed parallel requests failing with "Invalid credentials" instead of retrying with credentials obtained by another request (#13135)
• Fixed the GitHub API rate limit not being reported when the clone fallback fails (#13059)
• Fixed outdated reporting packages with no installable version as outdated (#13138)
• Fixed update --minimal-changes with wildcard package names (#13118)
• Fixed bump not handling >=10 style constraints and loosening OR constraints (#13133)
• Fixed security advisories wrongly applying to named dev branches like dev-main (#13089)
• Fixed the vendor dir not being excluded from root classmap scanning in some cases (#13018)
• Fixed self-update failing with a class not found error while swapping the phar (#13079)
• Fixed clear-cache --no-cache reporting missing dirs instead of the cache being disabled (#13092)
• Fixed empty script commands not being treated as a no-op (#13053)
• Fixed suggests silently outputting nothing when filtering on a package that is not installed or excluded by --no-dev, it now errors (#13014)
• Fixed JsonManipulator::addSubNode() modifying a nested key with the same name (#13109)
• Fixed repeated warnings from repositories being output multiple times (#13090)
• Fixed plugin capability classes being instantiated before checking they implement the right interfaces (#13139)
• Fixed warnings when finding packages within inline packages without uid (#13148)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

Full Changelog: 2.10.3...2.11.0