UnratedFix available
Composer 2.2.29 security fixes
Composer 2.2.29 includes security fixes for package-name and binary-path validation, URL credential sanitization, HTTP redirect handling, PHAR metadata unserialization, and JSON parse-error sanitization.
Announced Group revision 1
Original source ↗github-composer-composer
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
2.2.29 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx) Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3) Security: Only follow HTTP redirects from HTTP responses (#12948) Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946) Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
composer
Release notes from composer
- Affected versions
- Not stated in this extraction
- Fixed versions
- 2.2.29
2.2.29
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.
- Event
- #83635 · Revision 1
- Added to Heist Feed
- Publisher date