All Versions
128
Latest Version
Avg Release Cycle
17 days
Latest Release
2 days ago

Changelog History
Page 4

  • v2.0.0 Changes

    October 24, 2020

    Read the Composer 2.0 announcement first for the highlights!

    Complete 2.0 Changelog

    • ๐Ÿ’ฅ Breaking: This is a major release and while we tried to keep things compatible for most users, you might want to have a look at the UPGRADE guides
    • ๐ŸŽ Many CPU and memory performance improvements
    • โšก๏ธ The update command is now much more deterministic as it does not take the already installed packages into account
    • โšก๏ธ Package installation now performs all network operations first before doing any changes on disk, to reduce the chances of ending up with a partially updated vendor dir
    • ๐Ÿ“‡ Partial updates and require/remove are now much faster as they only load the metadata required for the updated packages
    • โž• Added a platform-check step when vendor/autoload.php gets initialized which checks the current PHP version/extensions match what is expected and fails hard otherwise. Can be disabled with the platform-check config option
    • โž• Added a Composer\InstalledVersions class which is autoloaded in every project and lets you check which packages/versions are present at runtime
    • โž• Added a composer-runtime-api virtual package which you can require (as e.g. ^2.0) to ensure things like the InstalledVersions class above are present. It will effectively force people to use Composer 2.x to install your project
    • โž• Added support for parallel downloads of package metadata and zip files, this requires that the curl extension is present and we thus strongly recommend enabling curl
    • โž• Added parallel installation of packages (requires OSX/Linux/WSL, and that unzip is present in PATH)
    • โž• Added much clearer dependency resolution error reporting for common error cases
    • โž• Added support for updating to a specific version with partial updates, as well as a --with flag to pass in temporary constraint overrides
    • โž• Added automatic removal of packages which are not required anymore whenever an update is done, this will purge packages previously left over by partial updates and require/remove
    • โž• Added support for TTY mode on Linux/OSX/WSL so that script handlers now run in interactive mode
    • โž• Added only, exclude and canonical options to all repositories, see repository priorities for details
    • ๐Ÿ“ฆ Added support for many new lib-* packages in the platform repository and improved version detection for some ext-* and lib-* packages
    • โž• Added pre-operations-exec event to be fired before the packages get installed/upgraded/removed
    • โž• Added pre-pool-create event to be fired before the package pool for the dependency solver is created, which lets you modify the list of packages going in
    • โž• Added post-file-download event to be fired after package dist files are downloaded, which lets you do additional checks on the files
    • โž• Added --locked flag to show command to see the packages from the composer.lock file
    • โž• Added --unused flag to remove command to make sure any packages which are not needed anymore get removed
    • โž• Added --dry-run flag to require and remove commands
    • โž• Added --no-install flag to update, require and remove commands to disable the install step and only do the update step (composer.lock file update)
    • โž• Added an --ask flag to create-project command to make Composer prompt for the install dir name, useful for project install instructions
    • โž• Added support for multiple --repository flags being passed into the create-project command, only useful in combination with --add-repository to persist them to composer.json
    • โž• Added --with-dependencies and --with-all-dependencies flag aliases to require and remove commands for consistency with update
    • โž• Added shorthand aliases -w for --with-dependencies and -W for --with-all-dependencies on update/require/remove commands
    • โž• Added more info to vendor/composer/installed.json, a dev key stores whether dev requirements were installed, and every package now has an install-path key with its install location
    • Added COMPOSER_DISABLE_NETWORK which if set makes Composer do its best to run offline. This can be useful when you have poor connectivity or to do benchmarking without network jitter
    • Added COMPOSER_DEBUG_EVENTS=1 env var support for plugin authors to figure out which events are triggered when
    • โž• Added setCustomCacheKey to PreFileDownloadEvent and fixed a cache bug for integrations changing the processed url of package archives
    • โž• Added Composer\Util\SyncHelper for plugin authors to deal with async Promises more easily
    • โž• Added $composer->getLoop()->getHttpDownloader() to get access to the main HttpDownloader instance in plugins
    • โž• Added --json and --merge flags to config command to allow editing complex extra.* values by using json as input
    • โž• Added confirmation prompt when running Composer as superuser in interactive mode
    • โž• Added --no-check-version to validate command to remove the warning in case the version is defined
    • โž• Added --ignore-platform-req (without s) to all commands supporting --ignore-platform-reqs, which accepts a package name so you can ignore only specific platform requirements
    • โž• Added --no-dev support to show and outdated commands to skip dev requirements
    • โž• Added --format=summary flag to license command
    • โž• Added a cache-read-only config option to make the cache usable in read only mode for containers and such
    • โž• Added support for wildcards (*) in classmap autoloader paths
    • โž• Added support for configuring GitLab deploy tokens in addition to private tokens, see gitlab-token
    • โž• Added support for package version guessing for require and init command to take all platform packages into account, not just php version
    • โž• Added support for tar in artifact repositories
    • โž• Added a non-zero exit code (2) and warning to remove command when a package to be removed could not be removed
    • โž• Added --apcu-autoloader-prefix (or --apcu-prefix for dump-autoload command) flag to let people use apcu autoloading in a deterministic output way if that is needed
    • ๐Ÿ›  Fixed package ordering when autoloading and especially when loading plugins, to make sure dependencies are loaded before their dependents
    • ๐Ÿ›  Fixed suggest output being very spammy, it now is only one line long and shows more rarely
    • ๐Ÿ›  Fixed conflict rules like e.g. >=5 from matching dev-master, as it is not normalized to 9999999-dev internally anymore
    • ๐Ÿ›  Fixed solver bug resulting in endless loops in some cases
    • ๐Ÿ›  Lots of minor bug fixes and improvements
  • v2.0.0-RC2 Changes

    October 14, 2020
    • Breaking: Removed OperationInterface::getReason as the data was not accurate
    • Added automatic removal of packages which are not required anymore whenever an update is done, this will purge packages previously left over by partial updates and require/remove
    • Added shorthand aliases -w for --with-dependencies and -W for --with-all-dependencies on update/require/remove commands
    • Added COMPOSER_DEBUG_EVENTS=1 env var support for plugin authors to figure out which events are triggered when
    • Added setCustomCacheKey to PreFileDownloadEvent and fixed a cache bug for integrations changing the processed url of package archives
    • Added Composer\Util\SyncHelper for plugin authors to deal with async Promises more easily
    • Added $composer->getLoop()->getHttpDownloader() to get access to the main HttpDownloader instance in plugins
    • Added a non-zero exit code (2) and warning to remove command when a package to be removed could not be removed
    • Added --apcu-autoloader-prefix (or --apcu-prefix for dump-autoload command) flag to let people use apcu autoloading in a deterministic output way if that is needed
    • Fixed version guesser to look at remote branches as well as local ones
    • Lots of minor bug fixes and improvements
  • v2.0.0-RC1 Changes

    September 10, 2020

    ๐Ÿš€ Not up to date with Composer 2 yet? Check the alpha1 changelog and alpha2 changelog and alpha3 changelog and especially the UPGRADE guide first.

    ๐Ÿš€ Try it out now and get ready for the upcoming stable release

    • โšก๏ธ Use composer self-update --preview to try the latest RC version (2.x).
    • โšก๏ธ Use composer self-update --snapshot to try the latest dev build (2.x).
    • ๐Ÿš€ Use composer self-update --stable to go back to stable releases (1.x for now).
    • ๐Ÿš€ Use composer self-update --1 in CI/scripts if you want to pin Composer to 1.x until you are ready to migrate, this will ensure you stay on 1.x releases even once a 2.0 stable comes out.

    ๐Ÿ”„ Changelog

    • โž• Added more advanced filtering to avoid loading all versions of all referenced packages when resolving dependencies, which should reduce memory usage further in some cases
    • ๐Ÿ“ฆ Added support for many new lib-* packages in the platform repository and improved version detection for some ext-* and lib-* packages
    • โž• Added an --ask flag to create-project command to make Composer prompt for the install dir name, useful for project install instructions
    • โž• Added support for tar in artifact repositories
    • โž• Added a cache-read-only config option to make the cache usable in read only mode for containers and such
    • โž• Added better error reporting for a few more specific cases
    • โž• Added a new optional available-package-patterns attribute for v2-format Composer repositories, see UPGRADE for details
    • ๐Ÿ›  Fixed more PHP 8 compatibility issues
    • ๐Ÿ›  Lots of minor bug fixes for regressions
  • v2.0.0-alpha3 Changes

    August 03, 2020

    ๐Ÿš€ Not up to date with Composer 2 yet? Check the alpha1 changelog and alpha2 changelog and UPGRADE guide first.

    ๐Ÿš€ Try it out now and get ready for the upcoming stable release

    • ๐Ÿš€ Use composer self-update --preview to try the latest alpha/prerelease version (2.x).
    • โšก๏ธ Use composer self-update --snapshot to try the latest dev build (2.x).
    • ๐Ÿš€ Use composer self-update --stable to go back to stable releases (1.x for now).
    • ๐Ÿš€ Use composer self-update --1 in CI/scripts if you want to pin Composer to 1.x until you are ready to migrate, this will ensure you stay on 1.x releases even once a 2.0 stable comes out.

    ๐Ÿ”„ Changelog

    • ๐Ÿ’ฅ Breaking: Zip archives loaded by artifact repositories must now have a composer.json on top level, or a max of one folder on top level of the archive
    • โž• Added --no-dev support to show and outdated commands to skip dev requirements
    • โž• Added support for multiple --repository flags being passed into the create-project command, only useful in combination with --add-repository to persist them to composer.json
    • โž• Added a new optional list API endpoint for v2-format composer repositories, see UPGRADE for details
    • ๐Ÿ›  Fixed show -a command not listing anything
    • ๐Ÿ›  Fixed solver bug where it ended in a "Reached invalid decision id 0"
    • ๐Ÿ›  Fixed updates of git-installed packages on windows
    • ๐Ÿ›  Lots of minor bug fixes
  • v2.0.0-alpha2 Changes

    June 24, 2020

    ๐Ÿš€ Not up to date with Composer 2 yet? Check the alpha1 changelog and UPGRADE guide first.

    ๐Ÿš€ Try it out now and get ready for the upcoming stable release

    • ๐Ÿš€ Use composer self-update --preview to try the latest alpha/prerelease version (2.x).
    • โšก๏ธ Use composer self-update --snapshot to try the latest dev build (2.x).
    • ๐Ÿš€ Use composer self-update --stable to go back to stable releases (1.x for now).
    • ๐Ÿš€ Use composer self-update --1 in CI/scripts if you want to pin Composer to 1.x until you are ready to migrate, this will ensure you stay on 1.x releases even once a 2.0 stable comes out.

    ๐Ÿ”„ Changelog

    • โž• Added parallel installation of packages (requires OSX/Linux/WSL, and that unzip is present in PATH)
    • โž• Added optimization of constraints by compiling them to PHP code, which should reduce CPU time of updates
    • โž• Added handling of Ctrl-C on Windows for PHP 7.4+
    • โž• Added better support for default branch names other than master
    • โž• Added --format=summary flag to license command
    • ๐Ÿ›  Fixed issue in platform check when requiring ext-zend-opcache
    • ๐Ÿ›  Fixed inline aliases issues
    • ๐Ÿ›  Fixed git integration issue when signatures are set to be shown by default
  • v2.0.0-alpha1 Changes

    June 03, 2020

    ๐Ÿš€ Try it out now and get ready for the upcoming stable release

    • ๐Ÿš€ Use composer self-update --preview to try the latest alpha/prerelease version (2.x).
    • โšก๏ธ Use composer self-update --snapshot to try the latest dev build (2.x).
    • ๐Ÿš€ Use composer self-update --stable to go back to stable releases (1.x for now).
    • ๐Ÿš€ Use composer self-update --1 in CI/scripts if you want to pin Composer to 1.x until you are ready to migrate, this will ensure you stay on 1.x releases even once a 2.0 stable comes out.

    ๐Ÿ”„ Changelog

    • ๐Ÿ’ฅ Breaking: This is a major release and while we tried to keep things compatible for most users, you might want to have a look at the UPGRADE guides
    • ๐ŸŽ Many CPU and memory performance improvements
    • โšก๏ธ The update command is now much more deterministic as it does not take the already installed packages into account
    • โšก๏ธ Package installation now performs all network operations first before doing any changes on disk, to reduce the chances of ending up with a partially updated vendor dir
    • ๐Ÿ“‡ Partial updates and require/remove are now much faster as they only load the metadata required for the updated packages
    • โž• Added a platform-check step when vendor/autoload.php gets initialized which checks the current PHP version/extensions match what is expected and fails hard otherwise. Can be disabled with the platform-check config option
    • โž• Added a Composer\InstalledVersions class which is autoloaded in every project and lets you check which packages/versions are present at runtime
    • โž• Added a composer-runtime-api virtual package which you can require (as e.g. ^2.0) to ensure things like the InstalledVersions class above are present. It will effectively force people to use Composer 2.x to install your project
    • โž• Added support for parallel downloads of package metadata and zip files, this requires that the curl extension is present and we thus strongly recommend enabling curl
    • โž• Added much clearer dependency resolution error reporting for common error cases
    • โž• Added support for updating to a specific version with partial updates, as well as a --with flag to pass in temporary constraint overrides
    • โž• Added support for TTY mode on Linux/OSX/WSL so that script handlers now run in interactive mode
    • โž• Added only, exclude and canonical options to all repositories, see repository priorities for details
    • โž• Added support for lib-zip platform package
    • โž• Added pre-operations-exec event to be fired before the packages get installed/upgraded/removed
    • โž• Added pre-pool-create event to be fired before the package pool for the dependency solver is created, which lets you modify the list of packages going in
    • โž• Added post-file-download event to be fired after package dist files are downloaded, which lets you do additional checks on the files
    • โž• Added --locked flag to show command to see the packages from the composer.lock file
    • โž• Added --unused flag to remove command to make sure any packages which are not needed anymore get removed
    • โž• Added --dry-run flag to require and remove commands
    • โž• Added --no-install flag to update, require and remove commands to disable the install step and only do the update step (composer.lock file update)
    • โž• Added --with-dependencies and --with-all-dependencies flag aliases to require and remove commands for consistency with update
    • โž• Added more info to vendor/composer/installed.json, a dev key stores whether dev requirements were installed, and every package now has an install-path key with its install location
    • Added COMPOSER_DISABLE_NETWORK which if set makes Composer do its best to run offline. This can be useful when you have poor connectivity or to do benchmarking without network jitter
    • โž• Added --json and --merge flags to config command to allow editing complex extra.* values by using json as input
    • โž• Added confirmation prompt when running Composer as superuser in interactive mode
    • โž• Added --no-check-version to validate command to remove the warning in case the version is defined
    • โž• Added --ignore-platform-req (without s) to all commands supporting --ignore-platform-reqs, which accepts a package name so you can ignore only specific platform requirements
    • โž• Added support for wildcards (*) in classmap autoloader paths
    • โž• Added support for configuring GitLab deploy tokens in addition to private tokens, see gitlab-token
    • โž• Added support for package version guessing for require and init command to take all platform packages into account, not just php version
    • ๐Ÿ›  Fixed package ordering when autoloading and especially when loading plugins, to make sure dependencies are loaded before their dependents
    • ๐Ÿ›  Fixed suggest output being very spammy, it now is only one line long and shows more rarely
    • ๐Ÿ›  Fixed conflict rules like e.g. >=5 from matching dev-master, as it is not normalized to 9999999-dev internally anymore
  • v1.10.23 Changes

    October 05, 2021
    • Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
  • v1.10.22 Changes

    April 27, 2021
    • Security: Fixed command injection vulnerability in HgDriver/HgDownloader and hardened other VCS drivers and downloaders (GHSA-h5h8-pc6h-jvvx / CVE-2021-29472)
  • v1.10.21 Changes

    April 01, 2021
    • Fixed support for new GitHub OAuth token format
    • Fixed processes silently ignoring the CWD when it does not exist
  • v1.10.20 Changes

    January 27, 2021
    • Fixed exclude-from-classmap causing regex issues when having too many paths
    • Fixed compatibility issue with Symfony 4/5