composer (2.10.2-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Avoid deeply nested multi constraints when matching security
    advisories / malware (#12935)
  * Add warnings in self-update when using soon to be deprecated versions,
    or when the php version is outdated (#12920)
  * Only follow http(s) redirects in HTTP transports (#12947)
  * Prevent phar metadata unserialization on unsafe php versions (#12945)
  * Sanitize JSON parse errors in Http\Response to avoid leaking response
    bodies (#12960)
  * Validate resolved packages before locking (GHSA-499r-g7pc-vmp9)
  * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
  * Sanitize URL-embedded usernames/tokens in verbose output
    (GHSA-g6xq-892h-64w3)
  * Release 2.10.2

  [ Eyüp Can Akman ]
  * Avoid writing backspaces to non-decorated output (#12925)
  * Don't hide a suggestion provided by the suggesting package itself (#12933)

  [ Keerthana ]
  * Fix audit output to use stdout for summary messages (#12904)

  [ Dimas Febri ]
  * Retry downloads failing with HTTP 400 on a fresh connection (#12962)

  [ David Prévot ]
  * Use relative path in autoload.php
  * Use build/vendor instead of vendor for homemade autoload.php

 -- David Prévot <taffit@debian.org>  Sat, 04 Jul 2026 20:10:04 +0200

composer (2.10.1-2) unstable; urgency=medium

  * Skip test failing with PHPUnit 13.2

 -- David Prévot <taffit@debian.org>  Thu, 11 Jun 2026 01:11:56 +0200

composer (2.10.1-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fixed `source-fallback` option applying to source->dist fallbacks as well
    (#12888)
  * Avoid duplicate output when a 400/500 request outputs a warning json
    response (#12907)
  * Verify backup signature on self-update --rollback (#12918)
  * Update changelog
  * Release 2.10.1

  [ Trevor Jacob Mathews ]
  * Fix shell escaping in config --editor (#12903)

  [ Aleksei Kankov ]
  * Avoid prompting for a GitHub token multiple times on parallel auth failures
    (#12913)

  [ Eyüp Can Akman ]
  * Check for local changes when switching a package from source to dist
    (#12912)

 -- David Prévot <taffit@debian.org>  Fri, 05 Jun 2026 13:38:06 +0200

composer (2.10.0-1) unstable; urgency=medium

  * Upload release to unstable

  [ Jordi Boggiano ]
  * Sanitize urls everywhere in output (#12882)
  * Disable source-fallback by default, mark it deprecated and remove
    env/flags to override
  * Fix issues checking URLs with uppercase URL schemes
  * Relax token validation on input, and hide more things on output (#12886)
  * Update changelog
  * Release 2.10.0

  [ PrinsFrank ]
  * Return non-zero exit code for "composer audit" when audit couldn't be
    performed due to missing required packages (#12880)

 -- David Prévot <taffit@debian.org>  Mon, 01 Jun 2026 10:33:28 +0200

composer (2.10.0~rc2-1) experimental; urgency=medium

  [ Jordi Boggiano ]
  * Release 2.10.0-RC2

  [ David Prévot ]
  * Document CVE in previouss changelog entry
  * Use full version with RequiresPhpunit

 -- David Prévot <taffit@debian.org>  Sun, 24 May 2026 08:49:12 +0200

composer (2.10.0~rc1-3) experimental; urgency=medium

  * Fix GITHUB_TOKEN disclosure in GitHub Actions logs (GHSA-f9f8-rm49-7jv2)
    [CVE-2026-45793]

 -- David Prévot <taffit@debian.org>  Wed, 13 May 2026 19:05:53 +0200

composer (2.10.0~rc1-2) experimental; urgency=medium

  * Fix command injection via malicious Perforce repository definition
    [CVE-2026-40261]
  * Fix command injection via malicious Perforce source reference/url
    [CVE-2026-40176]

 -- David Prévot <taffit@debian.org>  Sun, 19 Apr 2026 13:13:52 +0200

composer (2.10.0~rc1-1) experimental; urgency=medium

  * Upload RC to experimental

  [ Jordi Boggiano ]
  * Update docs for COMPOSER_NO_SECURITY_BLOCKING to include that it is
    supported in install command
  * Fix inconsistent treatment of SingleCommandApplication script commands
    (#12758)
  * Fix usage of insecure 3DES cipher suites when curl is disabled
  * Optimize plugin autoloading by avoiding regenerating classmaps and co for
    every package (#12696)
  * Release 2.10.0-RC1

  [ Yanick Witschi ]
  * Parse HTML in extension info when not on CLI (#12735)
  * Reduce PoolOptimizer memory usage in identical dependency grouping (#12783)

  [ Denis ]
  * Relay GitHub API error messages to the user on auth failures (#12737)

  [ mamazu ]
  * Improving the error message when package version can't be parsed (#12743)

  [ Jorg Adam Sowa ]
  * Fix credentials persisting in git mirror .git/config after clone or failed
    update
  * [Security] Enforce allow-plugins in non-interactive mode for pre-2.2 lock
    file (#12764)

  [ Jay-Way ]
  * Improve warning message when lockfile creation is disabled (#12760)

  [ Kuba Werłos ]
  * Bump only actually updated packages when running
    `composer update --bump-after-update` (#12733)

  [ Kay W. ]
  * Add `source-fallback` config option to disable/enable source fallback on
    download failure (#12698)

  [ discollizard ]
  * Add new --require param to create-project to add new packages to the
    project as it gets installed (#12738)

  [ ಠ_ಠ ]
  * Add support for temporary --with constraints with wildcards in
    UpdateCommand (#12658)

  [ David Prévot ]
  * Update Standards-Version to 4.7.4

 -- David Prévot <taffit@debian.org>  Mon, 06 Apr 2026 09:53:47 +0200

composer (2.9.5-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Revert "Work around issue with msys/rmdir on windows (#12726)"
  * Fix detection of 7z when it is installed as 7za
  * Release 2.9.5

  [ James Titcumb ]
  * Add support for PIE list of download-url-methods (#12727)

 -- David Prévot <taffit@debian.org>  Fri, 30 Jan 2026 06:34:54 +0100

composer (2.9.4-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix git rev-list usages to support older git versions (#12705)
  * Reorder diagnose output and add active plugins (#12706)
  * Sanitize invalid unicode sequences into question marks to avoid preg errors
  * Work around issue with msys/rmdir on windows (#12726)
  * Update changelog
  * Release 2.9.4

  [ Maksim Cherkasov ]
  * Disable HTTP/3 when HTTP proxy is used (#12699)

  [ heui ]
  * Replace substr with mb_substr for UTF-8 support (#12704)

 -- David Prévot <taffit@debian.org>  Sun, 25 Jan 2026 08:31:24 +0100

composer (2.9.3-1) unstable; urgency=medium

  * Security: Fixed ANSI sequence injection [CVE-2025-67746]

  [ Jordi Boggiano ]
  * Remove requirement that a full Composer instance be passed to
    EventDispatcher (#12629)
  * Fix update --lock / update mirrors not working when locked packages
    contain vulnerabilities, fixes #12634 (#12645)
  * Retry on curl timeouts (28) (#12662)
  * Use git rev-list instead of log to avoid issues with
    log.showSignature being enabled (#12666)
  * Fix regression in showing reasons for ignoring advisories (#12668)
  * Fix no-security-blocking / COMPOSER_NO_SECURITY_BLOCKING not working
    on updates done via the install command
  * Validate php-ext schema in ValidatingArrayLoader (#12694)
  * Fix support for securetransport + libressl
  * Release 2.9.3

  [ ಠ_ಠ ]
  * fix crash bumping version with composer update and disabled lockfile

  [ Ilia Urvachev ]
  * fix(AuthHelper): misplaced `username` and `password` (#12667)

  [ David Prévot ]
  * Update Standards-Version to 4.7.3
  * Convert d/watch to version 5

 -- David Prévot <taffit@debian.org>  Tue, 30 Dec 2025 16:00:43 +0100

composer (2.9.2-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * New flags to disable/configure blocking (#12617)
  * Add config command support for missing audit settings (#12609)
  * Add a way to configure block and audit specific ignores
  * Fix ignoring of CVE ids in security blocking
  * Fix partial updates failing when a locked package has security advisories
    (#12626)
  * Release 2.9.2

 -- David Prévot <taffit@debian.org>  Sun, 23 Nov 2025 09:18:53 +0100

composer (2.9.1-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix a few minor issues with bump-after-update flag (#12598)
  * Fix script autoloading regressions (#12606)
  * Fix null call of Command::setDescription, fixes #12605
  * Release 2.9.1

  [ Ruben Pascal Abel ]
  * Reverting 86b4aa1 to fix path resolution for vendor/bin proxies (#12601)

 -- David Prévot <taffit@debian.org>  Sat, 15 Nov 2025 14:07:52 +0100

composer (2.9.0~rc1-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Add support for --minimal-changes with full updates (#12349)
  * Improve performance of script handlers (#12456)
  * Ensure packages where the abandoned state changes get reinstalled to sync
    up the state in installed.json (#12423)
  * Add detection for preload being active and if it causes errors try to warn
    users (#12528)
  * Fix display of dist refs for dev versions when source is missing (#12562)
  * Add --locked flag to licenses command (#12595)
  * Release 2.9.0-RC1

  [ Ayesh Karunaratne ]
  * CurlDownloader - Add support for HTTP/3 (#12363)

  [ Lubomir Stanko ]
  * Add support to authorize with Custom Headers in auth.json or COMPOSER_AUTH
    env (#12372)

  [ Ilia Urvachev ]
  * feat(auth.json): support for authorization with client TLS-certificates
    (#12406)

  [ Alexis Lefebvre ]
  * doc: add SHELL_VERBOSITY to CLI (#12473)

  [ Ion Bazan ]
  * Add update-with-minimal-changes config option (#12545)
  * Allow non-interactive init without input (#12546)

  [ Stefan ]
  * feat: Added --ignore-unreachable flag to audit command for
    private/unreachable repositories (#12470)

  [ Stephan ]
  * Add driver to support forgejo/codeberge repositories (#12307)
  * Audit: add option to ignore individually abandoned packages (#12572)
  * Composer update: filter packages with security advisories from pool (#11956)

  [ Joshua Behrens ]
  * Add repo command to manipualte repositories in composer.json (#12388)

  [ Nicolas Grekas ]
  * Add COMPOSER_PREFER_DEV_OVER_PRERELEASE env var (#12585)

  [ Dan Wallis ]
  * [feature] Automatically recover from trivial merge conflicts in
    `composer.lock` (#11517)

 -- David Prévot <taffit@debian.org>  Mon, 10 Nov 2025 18:54:39 +0100

composer (2.8.12-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix php8.5 deprecation warning (#12513)
  * Bump json-schema min requirement
  * Bump symfony requirements
  * Drop react/promise 2.x again, refs #12188
  * Release 2.8.12

  [ ಠ_ಠ ]
  * fixes a regression introduced via 304107d (#12512)

  [ Stephan ]
  * Bitbucket: add support for API tokens (#12515)

  [ Daniel Pfeiffer ]
  * Allows for source to have a space in path name

  [ Kayw ]
  * Fix `--global` flag path resolution for bin-dir config

  [ Yanick Witschi ]
  * Reduce memory usage in PoolBuilder (#12516)

 -- David Prévot <taffit@debian.org>  Mon, 22 Sep 2025 12:35:31 +0200

composer (2.8.11-2) unstable; urgency=medium

  * Skip failure on 32-bit architectures

 -- David Prévot <taffit@debian.org>  Fri, 29 Aug 2025 10:29:23 +0200

composer (2.8.11-1) unstable; urgency=medium

  * Upload to unstable now that Trixie has been released

  [ Jordi Boggiano ]
  * Avoid bumping 0.3 to 0.4.3 for example for pre-1.0 releases, fixes #12468
  * Fix audit command failing when an advisory contains an invalid constraint
    (#12507)
  * Update changelog
  * Release 2.8.11

  [ Juliette ]
  * Update reactphp/promise for PHP 8.5 compatibility (#12504)
  * PHP 8.5 | Prevent deprecation notices for Reflection*::setAccessible()
    (#12493)

  [ Jorg Adam Sowa ]
  * fix: deprecation of curl_close in CurlDownloader.php (#12505)

  [ Alexey Kopytko ]
  * Fix PSR-4 warnings when using exclude-from-classmap with symlinked
    directories (#12480)

  [ David Prévot ]
  * Remove Rules-Requires-Root

 -- David Prévot <taffit@debian.org>  Tue, 26 Aug 2025 08:38:57 +0200

composer (2.8.10-1) experimental; urgency=medium

  [ Jordi Boggiano ]
  * Remove possessive quantifier to fix JS regex engines support for schema
    (#12438)
  * Fix git prompt breaking on some systems, fixes #12435 (#12437)
  * Avoid marking a plugin as loaded until it is actually loaded (#12442)
  * Fix deprecation message on PHP 8.4 when platform check fails (#12453)
  * Fix notification callback not being valid/reachable (#12472)
  * Release 2.8.10

  [ Steven Rombauts ]
  * Handle Planner role in GitLab (#12426)

  [ Robin Chalas ]
  * Add forward compatibility layer for symfony/console >7.4 (#12445)

  [ ConnorLock ]
  * Fix Bitbucket oauth failure (#12462)

 -- David Prévot <taffit@debian.org>  Sun, 13 Jul 2025 12:36:28 +0200

composer (2.8.9-1) experimental; urgency=medium

  * Upload to experimental during the freeze

  [ Jordi Boggiano ]
  * Do not output script being run when running via composer <script-name>
    (#12383)
  * Check the whole archive if a file looks like a zipbomb (#12409)
  * Fix creation of empty archives (#12408)
  * Update changelog
  * Release 2.8.9

  [ Christian Flothmann ]
  * ensure that version suffixes are case-insensitive (#12376)

  [ HypeMC ]
  * Don't run bump after update with `--lock` (#12371)

 -- David Prévot <taffit@debian.org>  Wed, 14 May 2025 08:37:55 +0200

composer (2.8.8-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix deprecation warnings in code inspections for vendor/autoload.php,
    fixes #12331
  * Upgrade json-schema to v6 (#12348)
  * Fix handling of replace together with the --with temporary constraints
    (#12353)
  * Fix error handler to bypass some new php 8.5 warnings and avoid spamming
    output too much with deprecation notices (#12360)
  * Fix InstalledVersions showing duplicates at Composer runtime during
    installation, fixes #12225 (#12361)
  * Fix some issues running tests on 32bit
  * Release 2.8.8

  [ Maarten Bruna ]
  * Add COMPOSER_MAX_PARALLEL_PROCESSES (#12356)

  [ David Prévot ]
  * Update Standards-Version to 4.7.2

 -- David Prévot <taffit@debian.org>  Sat, 05 Apr 2025 11:50:09 +0200

composer (2.8.6-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Add hint when avast is detected and we get a curl error 60, refs #9894
  * Add verbose output to show when scripts get skipped by the new env var,
    refs #12290
  * Release 2.8.6

  [ Sebastian Muszynski ]
  * Introduce COMPOSER_WITH_DEPENDENCIES and COMPOSER_WITH_ALL_DEPENDENCIES
    env var

  [ Stephan ]
  * Merge pull request #12290 from glaubinix/skip-scripts-for-certain-events

  [ Petar Obradović ]
  * feat: Detect containerd runtime and allow root execution (#12299)

  [ Philipp Scheit ]
  * ZipArchiver: treat backslaches in folder names on Unix (#12327)

  [ David Prévot ]
  * Update debian/clean
  * Modernize PHPUnit syntax

 -- David Prévot <taffit@debian.org>  Thu, 27 Feb 2025 23:08:48 +0100

composer (2.8.5-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix unstable order of psr-0 and psr-4 rules
  * Fix regression from #12233 in InstalledVersions when reload is used,
    fixes #12235
  * Release 2.8.5

  [ Andrew Nicols ]
  * Discard unsupported FUNDING.yml URL values

  [ jrfnl ]
  * GitHubDriver::getFundingInfo(): add support for thanks.dev and polar.sh

  [ Tim Düsterhus ]
  * Generate build provenance attestation during release

  [ David Prévot ]
  * Revert "Force system dependencies loading"
  * Revert "Fix regression from #12233 in InstalledVersions when reload is
    used, fixes #12235"

 -- David Prévot <taffit@debian.org>  Wed, 22 Jan 2025 08:22:33 +0100

composer (2.8.4-3) unstable; urgency=medium

  * Use --exclude-group multiple times (PHPUnit 11 fix)

 -- David Prévot <taffit@debian.org>  Fri, 10 Jan 2025 13:20:16 +0100

composer (2.8.4-2) unstable; urgency=medium

  * Refresh patch for PHPUnit 11

 -- David Prévot <taffit@debian.org>  Tue, 31 Dec 2024 14:23:28 +0100

composer (2.8.4-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Ensure installed.php data is sorted deterministically, fixes #12197
  * Fix bump-after-update when passing inline constraints, fixes #12223
  * Avoid duplicate errors in the output, fixes #12214
  * Fixed InstalledVersions returning duplicates in some instances
  * Fix create-project when passed with a path repo to disable symlinks by default
  * Avoid returning failing status code if the composer audit fails in diagnose command, refs #12196
  * Release 2.8.4

  [ Javier Spagnoletti ]
  * Use a bitmask to produce deterministic exit codes for the "audit" command
    (#12203)

  [ Lctrs ]
  * disable multiplexing for some versions of curl (#12207)

  [ Justin Beaty ]
  * Fix bug when plugin defines multiple PluginInterface classes (#12226)

 -- David Prévot <taffit@debian.org>  Mon, 23 Dec 2024 17:49:58 +0100

composer (2.8.3-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Avoid updating the lock hash if there is no lock
  * Release 2.8.3

 -- David Prévot <taffit@debian.org>  Mon, 18 Nov 2024 07:52:28 +0100

composer (2.8.2-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Clean up lock update code to remove redundancy and avoid errors (#12149)
  * Fix handling of signals in non-PHP binaries run via proxies (#12176)
  * Fix create-project regression when using path repos with relative paths,
    fixes #12150
  * Remove SignalHandler from Application to fix issues handling ctrl-C
    inside prompts
  * Release 2.8.2

  [ Christian Flothmann ]
  * do not stumble over missing descriptions (#12152)

 -- David Prévot <taffit@debian.org>  Sat, 02 Nov 2024 17:59:43 +0100

composer (2.8.1-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix a few cases where the prompt for using a parent dir's composer.json fails to work correctly, fixes #8023
  * Fix --strict-ambiguous to really report all issues, fixes #12140 (#12148)
  * Fix create-project to reuse the target folders permissions for files created (#12146)
  * Release 2.8.1

  [ Antal Áron ]
  * Allow init without license (#12145)

 -- David Prévot <taffit@debian.org>  Wed, 09 Oct 2024 14:52:18 +0200

composer (2.8.0-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix handling of COMPOSER_ROOT_VERSION to normalize according to
    expectations, fixes #12101 (#12109)
  * Fix handling of platform packages in why-not command and partial updates,
    fixes #12104 (#12110)
  * Add suggestions of provider packages for ext- and lib- packages (#12113)
  * Fix require command skipping new stability-flags from the lock file, fixes
    #11698 (#12112)
  * Add a way to control which scripts get args and where (#12086)
  * Respect sort-packages option when adding plugins to the allow-plugins list,
    fixes #11348
  * Add --strict-ambiguous to dump-autoload command (#12119)
  * Show warnings for each missing platform package in create-project, fixes
    #10736 (#12120)
  * Validate licenses passed into init command (#12115)
  * Add ability to reinstall packages by type (#12114)
  * Add --patch-only flag to update command to restrict updates to patch
    versions and make them safer (#12122)
  * Make version guessing more deterministic if two branches appear to be the
    base of a feature branch (#12129)
  * Fix init command to accept proprietary as license
  * Update changelog
  * Release 2.8.0

  [ Mohamed Hubail ]
  * Add `--abandoned` option (#12091)

  [ John Stevenson ]
  * Remove proxy transition fallback (#11938)

  [ Job Vink ]
  * Improve interactive package updates (#11990)

  [ Joe ]
  * Add allow-missing-requirements config setting to ignore missing
    requirements (#11966)

  [ Carlos Granados ]
  * Add option to run bump after update (#11942)

  [ Juliette ]
  * PHP 8.4 | Remove use of `E_STRICT` (#12116)

  [ PrinsFrank ]
  * Add dry-run argument to dump-autoload documentation (#12138)

  [ Johnson Page ]
  * Add `composer audit --ignore-severity` option (#12132)

  [ David Prévot ]
  * Change expected output in a test

 -- David Prévot <taffit@debian.org>  Fri, 04 Oct 2024 08:12:05 +0200

composer (2.7.9-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix docker detection breaking on constrained environments, fixes #12095
  * Release 2.7.9

 -- David Prévot <taffit@debian.org>  Fri, 06 Sep 2024 07:47:45 +0200

composer (2.7.8-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix archive command crashing if a path cannot be realpathed on windows,
    fixes #11544
  * Refactor the BasePackage::$stabilities into a constant
  * Fix addressability of branches containing # characters (#12042)
  * Improvements to docker detection (#12062)
  * Normalize namespaces in psr-0/psr-4 rules to fix edge cases, fixes
    #12028 (#12063)
  * Ensure COMPOSER_AUTH takes precedence over local auth.json, fixes #12084
  * Fix relative:true not being respected in path repo installs, fixes
    #12074 (#12092)
  * Fix duplicate libraries causing issues when conflicting extensions from
    core and pecl are installed concurrently (#12093)
  * Fix copy() sometimes failing on virtualbox shared folders, fixes #12057
  * Release 2.7.8

  [ Ilya Urvachev ]
  * fix(Locker): don't store transport-options.ssl within the lock-file (#12019)

  [ ADmad ]
  * Fix deprecation notice on PHP 8.4 (#12046)

  [ Sam L ]
  * Provide release-date/release-age and latest-release-date in composer outdated -A -f json (#12053)

 -- David Prévot <taffit@debian.org>  Sun, 01 Sep 2024 12:38:50 +0200

composer (2.7.7-2) unstable; urgency=medium

  * Use --require-file for phpabtl (Closes: #1074182)

 -- David Prévot <taffit@debian.org>  Tue, 25 Jun 2024 07:58:56 +0200

composer (2.7.7-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix Filesystem::isLocalPath including windows checks on linux
  * Fix perforce arg not being escaped correctly
  * Fix handling of zip bombs when unzipping archives
  * Fix UX when a non-required plugin is still present in vendor dir (#12000)
  * Fixed PSR violations for classes not matching the namespace of a rule being
    hidden, fixes #11957
  * Fix new platform requirements from composer.json not being checked when
    composer.lock is outdated, fixes #11989 (#12001)
  * Fix empty type support in init command, fixes #11999
  * Fix secure-http check to avoid bypass using emojis
  * Merge pull request from GHSA-v9qv-c7wm-wgmf [CVE-2024-35242]
    (Closes: #1073126)
  * Merge pull request from GHSA-47f6-5gq3-vx9c [CVE-2024-35241]
    (Closes: #1073125)
  * Fix windows parameter encoding to prevent abuse of unicode characters with
    best fit encoding conversion
  * Release 2.7.7

  [ Krzysztof Ciszewski ]
  * composer#11852 fix: ability to remove autoload* keys (#11967)
  * Fix composer error when git config safe.bareRepository is set to explicit
    (#11969)

  [ Dan Wallis ]
  * Close style tags to avoid bleed (#11972)

  [ Sam B ]
  * To enable to the TransportException code to be accessed in PHP < 8.1, make
    reflection property accessible (#11974)

 -- David Prévot <taffit@debian.org>  Thu, 13 Jun 2024 08:57:06 +0200

composer (2.7.6-3) unstable; urgency=medium

  * Compatibility with updated php-composer-class-map-generator

 -- David Prévot <taffit@debian.org>  Sat, 08 Jun 2024 07:52:56 +0200

composer (2.7.6-2) unstable; urgency=medium

  * Make provider functions static (PHPUnit 11 Fix) (Closes: #1070504)

 -- David Prévot <taffit@debian.org>  Mon, 20 May 2024 11:37:45 +0200

composer (2.7.6-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Workaround curl bug in 8.7.0/8.7.1, fixes #11913
  * Fix config command issue handling objects in some conditions, fixes #11945
  * Add new uninstall alias to docs
  * Fix binary proxies having an absolute path to vendor dir when project dir
    is a symlink, fixes #11947
  * Fix Composer autoloader being hijackable by script/plugin event handlers
    (#11955)
  * Fix transport exception not always using 255 exit code, fixes #11954
  * Tweak exit code for network errors to be 100, refs #11954
  * Fix private autoloader callbacks breaking the new runtime autoloader
    handling code
  * Release 2.7.6

  [ maximilian-walter ]
  * Don't show root warning for Podman containers (#11946)

  [ Buster Neece ]
  * Add "uninstall" as alias to "remove". (#11951)

 -- David Prévot <taffit@debian.org>  Sun, 05 May 2024 09:32:03 +0200

composer (2.7.4-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix composer status command handling of failed promises, closes #11889
  * Ensure integer env vars do not cause a crash, fixes #11908
  * Ensure we clear the locally configured cache dir instead of default one,
    fixes #11921
  * Fix show command output to remove v prefixes on versions, making for more
    uniform output, fixes #11925
  * Release 2.7.4

  [ Yanick Witschi ]
  * Only show warning about default version when not "project" type (#11885)

  [ Ayesh Karunaratne ]
  * [PHP 8.4] Fix for implicit nullability deprecation (#11888)

  [ Brad Jones ]
  * Surface the advisory ID when CVE not present. (#11892)

  [ gaxweb ]
  * Allow for SSH URLs when using hg repository type (#11878)

  [ Fabrizio Balliano ]
  * Added support for buy_me_a_coffee (#11902)

  [ John Stevenson ]
  * Refactor proxy handling to require https_proxy (#11915)

  [ Barry vd. Heuvel ]
  * Load ProxyManager before running command to fix autoload order (#11943)

  [ David Prévot ]
  * Update Standards-Version to 4.7.0
  * Drop version from build-dependencies

 -- David Prévot <taffit@debian.org>  Tue, 23 Apr 2024 08:06:18 +0200

composer (2.7.2-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix plugins still being available in a few special contexts when running
    as non-interactive root, mainly create-project, refs #11854
  * Optimize outdated --ignore to avoid fetching the latest package info for
    ignored packages, fixes #11863
  * Fix ensureDirectoryExists not working when a broken symlink appears
    somewhere in the path, fixes #11864
  * Release 2.7.2

  [ Pol Dellaiera ]
  * Add a warning message when Composer is not able to guess the root package
    version (#11858)
  * Fix update --lock to avoid updating all metadata except dist/source urls
    and mirrors (#11850)

  [ Michael Newton ]
  * Include PHP information when showing Composer version verbosely (#11866)

  [ Bastien Roucariès ]
  * Add salsa-ci.yml

 -- David Prévot <taffit@debian.org>  Tue, 12 Mar 2024 08:18:18 +0100

composer (2.7.1-2) unstable; urgency=medium

  * Force system dependencies loading

 -- David Prévot <taffit@debian.org>  Sun, 11 Feb 2024 12:08:01 +0100

composer (2.7.1-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Merge pull request from GHSA-7c6p-848j-wh5h [CVE-2024-24821]
    (Closes: #1063603)
  * Release 2.7.1

  [ David Prévot ]
  * Extend recommended packages list (Closes: #1061291)

 -- David Prévot <taffit@debian.org>  Sat, 10 Feb 2024 11:18:19 +0100

composer (2.6.6-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Release 2.6.6

  [ Dan Wallis ]
  * Use global constant if available for libpq version (#11684)
  * Display error instead of throwing exception when unable to update
    with temporary constraint (#11692)

 -- David Prévot <taffit@debian.org>  Tue, 12 Dec 2023 07:49:21 +0100

composer (2.6.5-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix autoload generator dump() non-BC signature change in 2.6.4
  * Release 2.6.5

  [ Uladzimir Tsykun ]
  * Fix error when vendor dir contains broken symlinks (#11670)

 -- David Prévot <taffit@debian.org>  Sun, 08 Oct 2023 09:17:05 +0200

composer (2.6.4-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Merge pull request from GHSA-jm6m-4632-36hf [CVE-2023-43655]
  * Release 2.6.4

 -- David Prévot <taffit@debian.org>  Tue, 03 Oct 2023 13:21:24 +0200

composer (2.6.3-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Fix loading of root aliases on path repo packages when doing partial
    updates, fixes #11630 (#11632)
  * Add audit.abandoned warnings for abandoned packages, fixes #11623 (#11639)
  * Release 2.6.3

  [ Christophe Coevoet ]
  * Fix the promise resolution for the cleanup logic (#11620)

  [ Jason McCreary ]
  * Get realpath for `ZipArchive` (#11636)

  [ Yanick Witschi ]
  * Fixed replaced packages being incorrectly missing when unlocked by an old
    version (#11629)

  [ wgevaert ]
  * Add warning when duplicate "files" autoload rules are detected (#11109)

 -- David Prévot <taffit@debian.org>  Sat, 16 Sep 2023 17:18:35 +0530

composer (2.6.2-1) unstable; urgency=medium

  [ Jordi Boggiano ]
  * Release 2.6.2

 -- David Prévot <taffit@debian.org>  Tue, 05 Sep 2023 20:05:50 +0530

composer (2.5.8-1) unstable; urgency=medium

  * Upload to unstable now that bookworm has been released

  [ Jordi Boggiano ]
  * Fix regression in edge cases where root package gets added to a repository
    already during the install process, fixes #11495
  * Fix EventDispatcher on windows picking bat files when using "@php binary",
    fixes #11490
  * Ignore ICU CDLR version fetching when ICU cannot initialize the resource
    bundle, fixes #11492
  * Update type declarations on ClassLoader, fixes #11482 (#11500)
  * Release 2.5.8

  [ David Prévot ]
  * Avoid option not compatible with PHPUnit 10

 -- David Prévot <taffit@debian.org>  Tue, 13 Jun 2023 07:21:32 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog composer`.
