- version update to 2.7.1 [bsc#1219757] CVE-2024-24821
  2.7.1
  * Added several warnings when plugins are disabled to hint at common problems people had with 2.7.0 (#11842)
  *  Fixed diagnose auditing of Composer dependencies failing when running from the phar
  2.7.0
  * Security: Fixed code execution and possible privilege escalation via compromised
    vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)
  * Changed the default of the audit.abandoned config setting to fail, set it to report or
    ignore if you do not want this, or set it via COMPOSER_AUDIT_ABANDONED env var (#11643)
  * Added --minimal-changes (-m) flag to update/require/remove commands to perform
    partial update with --with-dependencies while changing only what is absolutely
    necessary in transitive dependencies (#11665)
  * Added --sort-by-age (-A) flag to outdated/show commands to allow
     sorting by and displaying the release date (most outdated first) (#11762)
  * Added support for --self combined with --installed or --locked in show command, to
    add the root package to the package list being output (#11785)
  * Added severity information to audit command output (#11702)
  * Added scripts-aliases top level key in composer.json to define aliases for custom scripts you defined (#11666)
  * Added IPv4 fallback on connection timeout, as well as a COMPOSER_IPRESOLVE env var to force
    IPv4 or IPv6, set it to 4 or 6 (#11791)
  * Added support for wildcards in outdated's --ignore arg (#11831)
  * Added support for bump command bumping * to >=current version (#11694)
  * Added detection of constraints that cannot possibly match anything to validate command (#11829)
  * Added package source information to the output of install when running in very verbose (-vv) mode (#11763)
  * Added audit of Composer's own bundled dependencies in diagnose command (#11761)
  * Added GitHub token expiration date to diagnose command output (#11688)
  * Added non-zero status code to why/why-not commands (#11796)
  * Added error when calling show --direct <package> with an indirect/transitive dependency (#11728)
  * Added COMPOSER_FUND=0 env var to hide calls for funding (#11779)
  * Fixed bump command not bumping packages required with a v prefix (#11764)

• Files Changed
• Browse Source