2.2.32 - released 2026-11-10

View the release on GitHub

Changelog

  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13254)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13209)
  • Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13185)

Full Changelog: https://github.com/composer/composer/compare/2.2.31...2.2.32