-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 29 Aug 2026 13:39:42 +0200
Source: composer
Binary: composer
Architecture: all
Version: 2.8.8-1+deb13u4
Distribution: trixie
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Description:
 composer   - dependency manager for PHP
Changes:
 composer (2.8.8-1+deb13u4) trixie; urgency=medium
 .
   * Backport fixes from 2.10.2 and 2.10.3 releases:
     + Validate resolved packages before locking (GHSA-499r-g7pc-vmp9)
       [CVE-2026-59948]
     + Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
       [CVE-2026-59946]
     + Relax token validation on input, and hide more things on output (#12886)
     + Sanitize URL-embedded usernames/tokens in verbose output
       (GHSA-g6xq-892h-64w3) [CVE-2026-59947]
     + Security: Validate package bin paths against path traversal
       using symlinks (GHSA-96h3-5x6v-m776) [CVE-2026-59944]
     + Security: Fixed command injection via malicious Perforce url
       (GHSA-rvx4-ffvw-m9q3) [CVE-2026-84361]
Checksums-Sha1:
 311a53243ab7718134b45c36490479b2d5f054b2 10332 composer_2.8.8-1+deb13u4_all-buildd.buildinfo
 5ea53748822f89d1ee268cbd2863470e928c460f 536548 composer_2.8.8-1+deb13u4_all.deb
Checksums-Sha256:
 29e16a54e446da21b842db718b0318e8ed55579d24d82d5c96b2155dae12e868 10332 composer_2.8.8-1+deb13u4_all-buildd.buildinfo
 1949e97f6a477386e80d664ed1bdf270d3edc03bfa88d1ec837a9e0cbd8a51f6 536548 composer_2.8.8-1+deb13u4_all.deb
Files:
 e04a785ba37c2051267a04f86705f651 10332 php optional composer_2.8.8-1+deb13u4_all-buildd.buildinfo
 9577ff4ec1311324026b295373cfe393 536548 php optional composer_2.8.8-1+deb13u4_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmrsrzYACgkQaBVi67oX
tfk+PQ//YnOMfoXz7zgzmRQOuaB8z5yyKOveLuj4ViY6VFjmUPv9HRv70H3HopNI
ms+UOyxifOBMRCTUMSc2lpUbWIWjPHOd8ndL5lvBCZmoOBRGzDowkiKfVJa0kuxG
fbgiUwKI7emHvHtYc4FDK0/AQX8QSKRRt4AegSNgHbfMsaJ1E3a5n0MtSJb6Eapa
ZXVOucTdWEAqlix1Im6AeNTg/EmM1kCsrzxXNWfC4s1KHrbpD90qm7zM2Tv8c/nL
vd95bbYxDGcrP2PPiWBFHTv/Frtxxs9tWJCtw1JItLLhHL44dtuznKLZtMxT5XEl
fsmVu4Z9CDzzesJmcH8ZczPrTHW7z7X0DVwEjfq7efPLbCFfCCkJAGaBQakNjoOQ
FIk3JaLH8zwzcx0oF4atWhnWD4gx3WN7eznITd4iaq4WH7R+U1FYrSYUUkYXZRuJ
KghiUL1H9IdLskw3AFEOA/YQ9WkLYQZ3e2M73iVaFK9N0ynmOOni9Ti7/DYUq4zE
TrzIZEARyMK+elVVMPntw8ybXpbsC5OWtNbUbHPX8QJFSOEYzb7nuhm08PlmjZ8o
jaROLVkHG46JBapXAWQUwm894xysf9QLxZEhW78r7bk6HB0Ugd3wfCFN1ZnVZM0L
vikI2F/7Vszvd2kU/pkKBCQD25JLOYZJrFjOCpAXujls2XsrLwE=
=OhW9
-----END PGP SIGNATURE-----