platform
Composer: security advisories, deprecations and releases
Dependency manager for PHP that installs and updates libraries and application packages.
Get Composer alerts Free. No account. One email, and only when something touches your
stack.
- Items, 90 days
- 4
- Critical
- 0
- Last critical
- none
- This week
- 2
What your digest would have held this week
2 items from the last 7 days. Zero sends only the ones that touch your stack.
Security 1
- HIGH OpenSSF Blog · 17 Oct 2026
GitHub expands malware advisories to eight ecosystems via OpenSSF
GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
Deprecations 2
- HIGH NEW THIS WEEK ACT BY 29 OCT 2026 endoflife.date · 1 Nov 2026
Composer 2.10 has reached end of life
Composer 2.10 reached end of life on 2026-10-29, as listed by endoflife.date.
- MEDIUM ACT BY 31 DEC 2026 endoflife.date · 2 Oct 2026
Composer 2.2 reaches end of life on 2026-12-31
Composer 2.2 reaches end of life on 2026-12-31, as listed by endoflife.date.
Releases 1
- INFO NEW THIS WEEK endoflife.date · 1 Nov 2026
Composer 2.11 released
Composer 2.11 was released on 2026-10-29.
Only hear about Composer when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.