Bump composer/composer from 2.8.3 to 2.9.3

[dependabot]

Bumps composer/composer from 2.8.3 to 2.9.3.

Release notes

Sourced from composer/composer's releases.

2.9.3

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
• Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
• Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
• Fixed client-certificate authentication implementation (#12667)
• Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
• Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
• Fixed support for SecureTransport + LibreSSL on macOS (#12615)
• Fixed display of reasons for why advisories are ignored (#12668)
• Fixed compatibility issues when git has log.showSignature enabled (#12666)
• Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
• Fixed EventDispatcher requiring a full Composer instance to function (#12629)

Full Changelog: composer/composer@2.9.2...2.9.3

2.9.2

• Added new --no-security-blocking flag to disable/configure security blocking (#12617)
• Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
• Fixed config command not being able to set the new audit settings (#12609)
• Fixed handling audit.ignore to support CVE ids while doing security blocking, but advisory IDs are still preferred for performance reasons (#12624)
• Fixed partial updates failing when another package in the lock file has a known security advisory (#12626)

Full Changelog: composer/composer@2.9.1...2.9.2

2.9.1

• Fixed regression in phpunit binary proxies (#12601)
• Fixed script handler autoloading issues (#12606)
• Fixed null call of Command::setDescription in some cases (#12605)
• Fixed --prefer-lowest builds sometimes failing due to the filtering of versions with known vulnerabilities (#12603)

Full Changelog: composer/composer@2.9.0...2.9.1

2.9.0

Read the Composer 2.9 Release Announcement for more details on the release highlights.

Full Changelog

• Bumped composer-plugin-api to 2.9.0
• Added automatic blocking of packages with security advisories from updates (#11956)
• Added audit > block-insecure config setting to control blocking of updates to package versions with known security advisories (defaults to true) (#11956)
• Added audit > block-abandoned config setting to control blocking of updates to abandoned packages (defaults to false) (#11956)
• Added audit > ignore-abandoned config setting to ignore some packages (#12572)
• Added --ignore-unreachable flag to audit command to allow running audit in environments that do not have access to some repos (#12470)
• Added repository command to add, remove, or update repositories more easily (#12388)
• Updated repositories structure to contain a name attribute and being stored preferably as list instead of object (#12388)
• Added support for --minimal-changes full updates where only packages that need changing to satisfy modified constraints are updated (#12349)
• Added update-with-minimal-changes config setting (and COMPOSER_MINIMAL_CHANGES env var) to default to minimal changes (#12545)
• Added support for forgejo / codeberg.org repositories (#12307)
• Added automatic recovery of simple lock file conflicts when running update with a file that has a content-hash conflict (#11517)
• Added support for HTTP/3 if libcurl supports it (#12363)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.9.3] 2025-12-30

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
• Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
• Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
• Fixed client-certificate authentication implementation (#12667)
• Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
• Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
• Fixed support for SecureTransport + LibreSSL on macOS (#12615)
• Fixed display of reasons for why advisories are ignored (#12668)
• Fixed compatibility issues when git has log.showSignature enabled (#12666)
• Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
• Fixed EventDispatcher requiring a full Composer instance to function (#12629)

[2.9.2] 2025-11-19

• Added new --no-security-blocking flag to disable/configure security blocking (#12617)
• Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
• Fixed config command not being able to set the new audit settings (#12609)
• Fixed handling audit.ignore to support CVE ids while doing security blocking, but advisory IDs are still preferred for performance reasons (#12624)
• Fixed partial updates failing when another package in the lock file has a known security advisory (#12626)

[2.9.1] 2025-11-13

• Fixed regression in phpunit binary proxies (#12601)
• Fixed script handler autoloading issues (#12606)
• Fixed null call of Command::setDescription in some cases (#12605)
• Fixed --prefer-lowest builds sometimes failing due to the filtering of versions with known vulnerabilities (#12603)

[2.9.0] 2025-11-13

• Fixed a couple minor issues with --bump-after-update (#12598)
• Various docs fixes

[2.9.0-RC1] 2025-11-07

• Bumped composer-plugin-api to 2.9.0
• Added automatic blocking of packages with security advisories from updates (#11956)
• Added audit > block-insecure config setting to control blocking of updates to package versions with known security advisories (defaults to true) (#11956)
• Added audit > block-abandoned config setting to control blocking of updates to abandoned packages (defaults to false) (#11956)
• Added audit > ignore-abandoned config setting to ignore some packages (#12572)
• Added --ignore-unreachable flag to audit command to allow running audit in environments that do not have access to some repos (#12470)
• Added repository command to add, remove, or update repositories more easily (#12388)
• Updated repositories structure to contain a name attribute and being stored preferably as list instead of object (#12388)
• Added support for --minimal-changes full updates where only packages that need changing to satisfy modified constraints are updated (#12349)
• Added update-with-minimal-changes config setting (and COMPOSER_MINIMAL_CHANGES env var) to default to minimal changes (#12545)
• Added support for forgejo / codeberg.org repositories (#12307)
• Added automatic recovery of simple lock file conflicts when running update with a file that has a content-hash conflict (#11517)
• Added support for HTTP/3 if libcurl supports it (#12363)
• Added support for custom header authentication (#12372)

... (truncated)

Commits

• fb3bee2 Release 2.9.3
• 32bc150 Update changelog
• 5db1876 Merge commit from fork
• 47cde53 Fix support for securetransport + libressl
• 29105dc Use new composer/hello-world package in the docs, fixes #12684
• 9d93dda Update deps
• 35c287d Validate php-ext schema in ValidatingArrayLoader (#12694)
• f935eec Bump actions/cache from 4.3.0 to 5.0.1 (#12679)
• 00123d5 Bump actions/attest-build-provenance from 3.0.0 to 3.1.0 (#12688)
• b824a0d Add a way to disable git fallback in GitHubDriver
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.