Composer 2.10.3

Composer 2.10.3 landed on August 27, 2026, and if you are running the PHP ecosystem this is a version you want quickly. The headline is a stack of security fixes, several of which cover remote code execution paths.

Security Patches You Should Care About

The release hardens package bin path validation against path traversal through symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944), fixes a command injection via malicious Perforce URLs, sanitizes URL-embedded credentials in more places, and corrects GitLab URL matching to avoid leaking credentials to the wrong host.

Stability and Concurrency Fixes

Beyond security, 2.10.3 fixes PHP 4.6 deprecation warnings, clears up the error output when a policy blocks a package version, and addresses a race condition when multiple Composer processes create the cache directory in parallel.

The Skeptic's Take

This is a patch, not a feature release. That is the point: Composer has spent 2.10.0 through 2.10.3 plugging holes and stabilizing the new filter-list and policy config landed earlier in the series. Upgrade for the CVEs, not for new toys. If you depend on Perforce or self-hosted GitLab, upgrade before your next deploy regardless of what your release train normally does.