Issues

Issues

• outdated --minor-only/--patch-only reports the dev branch when the installed version is still in the cooldown

  composer/composer#13263 · opened on Nov 11, 2026

• composer audit fails on a connection timeout instead of retrying

  composer/composer#13256 · opened on Nov 9, 2026

• Plugin runtime autoloader uses vendor/ paths for root dependencies installed by custom installers ("Could not scan for classes" warning)

  Bug

  composer/composer#13248 · opened on Nov 7, 2026
  4

• Cooldown policy replaces a withheld security release with its dev branch

  composer/composer#13247 · opened on Nov 7, 2026 · 2.11

• composer audit: Warn when security advisory coverage is indeterminate for dev dependencies

  Feature

  composer/composer#13245 · opened on Nov 6, 2026

• Document transport-options on package metadata

  Documentation

  composer/composer#13236 · opened on Nov 5, 2026 · 2.11
  1

• Tar::getComposerJson ignores non-directory entries at archive root, leading to unwrapping failure during install

  Bug

  composer/composer#13232 · opened on Nov 4, 2026

• only-branches: also load branches explicitly required by the root package (dev-*)

  Feature

  composer/composer#13212 · opened on Nov 2, 2026

• Rename $allowPartialAdvisories to $preferFullAdvisories in advisory loading APIs

  composer/composer#13150 · opened on Oct 21, 2026 · 3.0

• Abandoned packages not always reported

  Bug

  composer/composer#13122 · opened on Oct 15, 2026 · 2.12

• Allow installing PIE extensions as dev packages for stub distribution

  Feature

  composer/composer#13112 · opened on Oct 8, 2026

• Options don't get passed to scripts as additional arguments

  Bug

  composer/composer#13038 · opened on Aug 14, 2026
  1

• Partial update with -w/-W reports a symlinked path-repository package's locked dependency as "not loaded, likely because it conflicts with another require"

  composer/composer#13024 · opened on Aug 7, 2026 · 2.12

• Conflict handling with require --no-update-dev

  Bug

  composer/composer#13017 · opened on Aug 4, 2026
  2

• weird error preventing composer from working properly

  Support

  composer/composer#13003 · opened on Jul 24, 2026
  1

• Introduce an equivalent of npm audit fix

  Feature

  composer/composer#12989 · opened on Jul 20, 2026 · Nice To Have
  2

• composer audit - list of ignored CVEs from file/parameter

  Feature

  composer/composer#12954 · opened on Jun 26, 2026 · Nice To Have
  1

• A composer update that only updates metadata for a package, generates an upgrade to the same version without additional context

  Feature

  composer/composer#12944 · opened on Jun 23, 2026 · Nice To Have
  1

• Advisory ignore list expiry

  Feature

  composer/composer#12943 · opened on Jun 22, 2026 · Nice To Have

• RFC: Dependency Lifecycle Scripts

  Feature

  composer/composer#12938 · opened on Jun 18, 2026
  2

• getcomposer.org installer downloads: hosting availability in CI

  Support

  composer/composer#12928 · opened on Jun 9, 2026
  3

• Globally (homedir) installed composer fails to update itself

  Bug

  composer/composer#12922 · opened on Jun 5, 2026
  5

• Composer Audit, No security vulnerability advisories found.

  composer/composer#12921 · opened on Jun 5, 2026

• Support block-scope for custom dependency policies

  Feature

  composer/composer#12917 · opened on Jun 3, 2026
  1

• Fine-grained GitHub PATs cause 403 on public-repo dist fetches because github-oauth/http-basic auth is host-wide

  Feature

  composer/composer#12915 · opened on Jun 3, 2026 · Nice To Have
  1