Composer 2.1.9 and 1.12.23 released with security and bug fixes

Published On2021-10-05

# Composer 2.1.9 and 1.12.23 released with security and bug fixes
Composer, the PHP dependency manager released versions 2.1.9 and 1.12.23 that contain a security fix and bug fixes.

This release fixes a command-injection vulnerable that was caused by erroneous command line escaping in Windows systems. The security vulnerability is assigned CVE-2021-41116 and GHSA-frqg-7g38-6gcf.

Composer running on operating systems other than Windows are not affected. Further, Composer run on Windows Subsystem for Linux (WSL) are not affected either.

Affected Versions and Released Versions

  • Composer 1.x series: All versions prior to 1.10.22 are vulnerable. Update to Composer 1.10.22 or later.
  • Composer 2.x series: All versions prior to 2.1.9 are vulnerable. Update to Composer 2.1.9 or later.

Updating Composer

To update Composer installed on system, run:

composer self-update

Projects that use Composer versions prior to 2.1.9 (in 2.x series) and 1.12.23 (in 1.x series), and have enabled GitHub with Dependabot should start to receive a security alert in coming hours. It is not required to declare composer/composer as a dependency unless that project depends on the APIs provided by Composer; This majorly includes Composer plugins.

To update the Composer version required for a Composer plugin, update the composer/composer requirement in composer.json file.

"require": {
-  "composer/composer": "^2.0.13"
+  "composer/composer": "^2.1.9"
}

In other news on PHP.Watch

All NewsFeed
PHP 8.2 Released

PHP 8.2 Released

PHP 8.2 is now generally available!
All PHP 7.x versions are now EOL

All PHP 7.x versions are now EOL

PHP 7.4, the last PHP version in 7.x series, reached its End-of-Life date on November 28th. PHP 7.4 received one year of security fixes (but no bug fixes) from November 2021. PHP 7.4.33 is the last PHP version.
PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2 Release managers announced today that due to a newly found bug in PHP's Opcache, PHP 8.2.0 release will be rescheduled to December 8th.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.