Composer 2.1.9 and 1.12.23 released with security and bug fixes

Published On2021-10-05

# Composer 2.1.9 and 1.12.23 released with security and bug fixes
Composer, the PHP dependency manager released versions 2.1.9 and 1.12.23 that contain a security fix and bug fixes.

This release fixes a command-injection vulnerable that was caused by erroneous command line escaping in Windows systems. The security vulnerability is assigned CVE-2021-41116 and GHSA-frqg-7g38-6gcf.

Composer running on operating systems other than Windows are not affected. Further, Composer run on Windows Subsystem for Linux (WSL) are not affected either.

Affected Versions and Released Versions

  • Composer 1.x series: All versions prior to 1.10.22 are vulnerable. Update to Composer 1.10.22 or later.
  • Composer 2.x series: All versions prior to 2.1.9 are vulnerable. Update to Composer 2.1.9 or later.

Updating Composer

To update Composer installed on system, run:

composer self-update

Projects that use Composer versions prior to 2.1.9 (in 2.x series) and 1.12.23 (in 1.x series), and have enabled GitHub with Dependabot should start to receive a security alert in coming hours. It is not required to declare composer/composer as a dependency unless that project depends on the APIs provided by Composer; This majorly includes Composer plugins.

To update the Composer version required for a Composer plugin, update the composer/composer requirement in composer.json file.

"require": {
-  "composer/composer": "^2.0.13"
+  "composer/composer": "^2.1.9"
}

In other news on PHP.Watch

All NewsFeed
PHP 8.2 Release Managers Elected

PHP 8.2 Release Managers Elected

Ben Ramsey, Sergey Panteleev, and Pierrick Charron elected as the Release Managers for PHP 8.2, which is scheduled to be released on 24th of Nov, 2022.
PHP Project Adds GitHub Actions for CI/CD

PHP Project Adds GitHub Actions for CI/CD

PHP project adds GitHub Actions CI/CD for Linux and Mac OS builds.
PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes

PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes

PHP versions 8.1.3, 8.0.28, and 7.4.28 are released with security and bug fixes. There are is no corresponding 7.3 release because PHP 7.3 series have reached their End Of Life.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.