Composer 2.1.9 and 1.12.23 released with security and bug fixes

Published On2021-10-05

# Composer 2.1.9 and 1.12.23 released with security and bug fixes
Composer, the PHP dependency manager released versions 2.1.9 and 1.12.23 that contain a security fix and bug fixes.

This release fixes a command-injection vulnerable that was caused by erroneous command line escaping in Windows systems. The security vulnerability is assigned CVE-2021-41116 and GHSA-frqg-7g38-6gcf.

Composer running on operating systems other than Windows are not affected. Further, Composer run on Windows Subsystem for Linux (WSL) are not affected either.

Affected Versions and Released Versions

  • Composer 1.x series: All versions prior to 1.10.22 are vulnerable. Update to Composer 1.10.22 or later.
  • Composer 2.x series: All versions prior to 2.1.9 are vulnerable. Update to Composer 2.1.9 or later.

Updating Composer

To update Composer installed on system, run:

composer self-update

Projects that use Composer versions prior to 2.1.9 (in 2.x series) and 1.12.23 (in 1.x series), and have enabled GitHub with Dependabot should start to receive a security alert in coming hours. It is not required to declare composer/composer as a dependency unless that project depends on the APIs provided by Composer; This majorly includes Composer plugins.

To update the Composer version required for a Composer plugin, update the composer/composer requirement in composer.json file.

"require": {
-  "composer/composer": "^2.0.13"
+  "composer/composer": "^2.1.9"
}

In other news on PHP.Watch

All NewsFeed
PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2 Release managers announced today that due to a newly found bug in PHP's Opcache, PHP 8.2.0 release will be rescheduled to December 8th.
PHP 8.1.11, 8.0.24, and 7.4.32 released with security and bug fixes

PHP 8.1.11, 8.0.24, and 7.4.32 released with security and bug fixes

New PHP versions 8.1.1, 8.0.24, and 7.4.32 released, and they contain bug fixes and security fixes how PHP handles gzip files and cookies.
Longhorn PHP 2022 CFP Open

Longhorn PHP 2022 CFP Open

Longhorn PHP, one of the biggest PHP conferences in Texas, is now accepting talks for Longhorn PHP 2022, scheduled for November 3-5 in Austin, Texas.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.