2.3.3

• Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
• Added missing config.bitbucket-oauth in composer-schema.json
• Fixed type errors in SvnDriver (#10681)
• Fixed --version output to match the pre-2.3 one (#10684)
• Fixed config/auth.json files not being validated against the composer-schema.json (#10685)
• Fixed generation of autoload crashing if a package has a broken path (#10688)
• Fixed GitDriver state issue when reusing old cache dirs and the default branch was renamed (#10687)
• Updated semver, jsonlint deps for minor fixes
• Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and extracting dev deps (#10651)

2.2.11

• Added missing config.bitbucket-oauth in composer-schema.json
• Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
• Updated semver, jsonlint deps for minor fixes
• Fixed generation of autoload crashing if a package has a broken path (#10688)
• Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and extracting dev deps (#10651)

2.3.2

• Fixed type error when running exec command (#10672)
• Fixed endless loop in plugin activation prompt when input is not fully interactive yet appears to be (#10648)
• Fixed type error in ComposerRepository (#10675)
• Fixed issues loading platform packages where the version of a library cannot be established (#10631)

2.3.1

• Fixed type error when HOME env var is not set (#10670)

2.3.0

Read the Composer 2.3 Release Announcement for more details on the release highlights.

Complete Changelog

• BC Break: the minimum PHP version is now 7.2.5+, use the Composer 2.2 LTS if you are stuck with an older PHP (#10343)
• BC Break: added native parameter & return types to many internal APIs, we explicitly left the most extended/implemented symbols untouched but if this causes problems nonetheless please report it ASAP (#10547, #10561)
• BC Break: added visibility to all constants, a few internal ones have been made private/protected, if this causes problems please report it ASAP (#10550)
• BC Break: the minimum supported Symfony components version is now 5.4, this only affects you if you are requiring composer/composer directly however, which is generally frowned upon
• Bumped composer-plugin-api to 2.3.0
• Bumped bundled Symfony components from 2.8 to 5.4 🥳
• Added declare(strict_types=1) to all the classes, which for sure could cause regressions in edge cases, please report with stack traces (#10567)
• Added --patch-only to the outdated command to only show updates to patch versions and ignore new major/minor versions (#10589)
• Added clickable links to various commands for terminals which support it (#10430)
• Added ProcessExecutor ability to receive commands as arrays by (internals/plugin change only) (#10435)
• Added abandoned flag to show/outdated commands JSON-formatted output (#10485)
• Added config.reference option to path repositories to configure the way the reference is generated, and possibly reduce composer.lock conflicts (#10488)
• Added automatic removal of allow-plugins rules when removing a plugin via the remove command (#10615)
• Added COMPOSER_IGNORE_PLATFOR_REQ & COMPOSER_IGNORE_PLATFOR_REQS env vars to configure the equivalent flags (#10616)
• Added support for Symfony 6.0 components
• Added support for psr/log 3.x (#10454)
• Fixed symlink creation in linux VM guest filesystems to be recognized by Windows (#10592)
• Performance improvement in pool optimization step (#10585)
• Performance improvement in Composer bootstrapping (version guessing) when on a feature branch (#10632)

2.2.10

• Fixed Bitbucket authorization detection due to API changes (#10657)
• Fixed validate command warning about dist/source keys if defined (#10655)
• Fixed deletion/handling of corrupted 0-bytes zip archives (#10666)

2.3.0-RC2

• Fixed invalid return value in ComposerRepository::findPackage (#10622)
• Fixed many show command issues due to a flipped condition (#10623)
• Fixed phpversion() handling when it returns false due to an extension defining no version (#10631)
• Fixed remove command failing when no allow-plugin is defined in config (#10629)
• Performance improvement in Composer bootstrapping (version guessing) when on a feature branch (#10632)

2.3.0-RC1

Composer 2.3 is ready for a release, and we need your help to help test it and report any regression.

This release is special as it contains almost only big internal changes allowing us to modernize our PHP code:

• Upgraded minimum supported PHP version from 5.3.2 to 7.2.5
• Upgraded symfony component dependencies from 2.8.x to 5.4.x
• Added scalar parameter types where possible, this should not break anything as PHP 7.2 contravariance allows this
• Added return types where possible. This will break code that extends ours and does not declare the same return types. For this reason, our most extended classes/interfaces have not been modified to retain BC: Composer\IO\*, Composer\Installer\*, Composer\Autoload\ClassLoader, Composer\InstalledVersions, Composer\Plugin\*, Composer\Repository\*, Composer\Util\{Filesystem,HttpDownloader,RemoteFilesystem} and a few select others. Hopefully this avoids most breakage, but we may still see some extensions break. If you can fix these breakages by adding return types and move on that would be the preferred way, but if they are breaking established plugins or others which cannot easily be updated everywhere they're used we will rollback those return type additions as needed.
• Added declare(strict_types=1) to all files, which is likely to break some edge case things which were not caught by the test suite.

We'd be very glad if anyone can try it out with their projects, and especially for people extending Composer in some way (plugin or other) to try it out.

Please try it out!

• Running composer self-update --preview will get you the 2.3.0-RC1 (if you are running PHP 7.2.5 or above)
• Running composer self-update --stable will get you back on the latest 2.2 stable release if things broke.
• Report any issues you encounter as a new issue specifying you tried the 2.3 RC and please include stack traces & repro details.

Full Changelog

• BC Break: the minimum PHP version is now 7.2.5+, use the Composer 2.2 LTS if you are stuck with an older PHP (#10343)
• BC Break: added native parameter & return types to many internal APIs, we explicitly left the most extended/implemented symbols untouched but if this causes problems nonetheless please report it ASAP (#10547, #10561)
• BC Break: added visibility to all constants, a few internal ones have been made private/protected, if this causes problems please report it ASAP (#10550)
• BC Break: the minimum supported Symfony components version is now 5.4, this only affects you if you are requiring composer/composer directly however, which is generally frowned upon
• Bumped composer-plugin-api to 2.3.0
• Bumped bundled Symfony components from 2.8 to 5.4 🥳
• Added declare(strict_types=1) to all the classes, which for sure could cause regressions in edge cases, please report with stack traces (#10567)
• Added --patch-only to the outdated command to only show updates to patch versions and ignore new major/minor versions (#10589)
• Added clickable links to various commands for terminals which support it (#10430)
• Added ProcessExecutor ability to receive commands as arrays by (internals/plugin change only) (#10435)
• Added abandoned flag to show/outdated commands JSON-formatted output (#10485)
• Added config.reference option to path repositories to configure the way the reference is generated, and possibly reduce composer.lock conflicts (#10488)
• Added automatic removal of allow-plugins rules when removing a plugin via the remove command (#10615)
• Added COMPOSER_IGNORE_PLATFOR_REQ & COMPOSER_IGNORE_PLATFOR_REQS env vars to configure the equivalent flags (#10616)
• Added support for Symfony 6.0 components
• Added support for psr/log 3.x (#10454)
• Fixed symlink creation in linux VM guest filesystems to be recognized by Windows (#10592)
• Performance improvement in pool optimization step (#10585)

2.2.9

• Fixed regression with plugins that modify install path of packages, see docs if you are authoring such a plugin (#10621)

2.2.8

• Fixed files autoloading sort order to be fully deterministic (#10617)
• Fixed pool optimization pass edge cases (#10579)
• Fixed require command failing when self.version is used as constraint (#10593)
• Fixed --no-ansi / undecorated output still showing color in repo warnings (#10601)
• Performance improvement in pool optimization step (composer/semver#131)