-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 29 Aug 2026 13:39:42 +0200
Source: composer
Architecture: source
Version: 2.8.8-1+deb13u4
Distribution: trixie
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
 composer (2.8.8-1+deb13u4) trixie; urgency=medium
 .
   * Backport fixes from 2.10.2 and 2.10.3 releases:
     + Validate resolved packages before locking (GHSA-499r-g7pc-vmp9)
       [CVE-2026-59948]
     + Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
       [CVE-2026-59946]
     + Relax token validation on input, and hide more things on output (#12886)
     + Sanitize URL-embedded usernames/tokens in verbose output
       (GHSA-g6xq-892h-64w3) [CVE-2026-59947]
     + Security: Validate package bin paths against path traversal
       using symlinks (GHSA-96h3-5x6v-m776) [CVE-2026-59944]
     + Security: Fixed command injection via malicious Perforce url
       (GHSA-rvx4-ffvw-m9q3) [CVE-2026-84361]
Checksums-Sha1:
 7044deed36cabc5663a95dbf696a9e2980520b72 2254 composer_2.8.8-1+deb13u4.dsc
 4b4654bd19b7af912e2634ae43f294dcf5f201c2 69356 composer_2.8.8-1+deb13u4.debian.tar.xz
 edfa987b6665b1b7f2286c6584ad2a207b5c2933 10203 composer_2.8.8-1+deb13u4_amd64.buildinfo
Checksums-Sha256:
 28b6fb5ce0eb80543924815bd6b3009ae1d62a205d824b834c567be85cfd8750 2254 composer_2.8.8-1+deb13u4.dsc
 bcf42c4236588d860678db60a01a948f310b3b6898d54a2c754b2cc33d15813a 69356 composer_2.8.8-1+deb13u4.debian.tar.xz
 590e85c81f09c6e966837612dc6438ba432d5159ab463bd7cb69b94586d71a28 10203 composer_2.8.8-1+deb13u4_amd64.buildinfo
Files:
 2c00d565d607af63efc6b474a3e9f030 2254 php optional composer_2.8.8-1+deb13u4.dsc
 10635be96321e8e07d6e1012e561805d 69356 php optional composer_2.8.8-1+deb13u4.debian.tar.xz
 8adfe309bd3c3e639ae378998a15da08 10203 php optional composer_2.8.8-1+deb13u4_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmqeZTYSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08pcgH/2jpRG9SLYapfCsb+LmE9fXQZNc8maMY
4LkB9WTdV5Cfm6rBoi/ygSGhbYl8DpKIy4zzA/+rnNJ474zaC0GipeHZOivtPhxB
8gQm0ia/xNAtTjnoef5XqFsGzmhkn7CkEiBxBIYbAGm7XNqoxTuVCqD3LnMUlXj4
FkYZymMHzGRNG2OS4zMYIjDBbMpuWt+cpgql3DpQy5niARB8gdfTeY5uRUK8PxKP
+kw7/dQe+M8cBbj6KfCpVUSAEOdiR7DASpP38eyEQ5EcE831SRWHzO3wV8lSCvLL
/Qh8ZDREVFJBcBrpeihP9gBtpmmMYzjJ4NqlIP6Wg7D5NIbntDjhzc8=
=/PQp
-----END PGP SIGNATURE-----