fix(supported-version): bump Composer 2.9.8 to 2.10.2 - #386
Merged
rhoerr merged 1 commit intoJul 28, 2026
Conversation
Composer 2.9.8 is affected by CVE-2026-59946, CVE-2026-59947 and CVE-2026-59948 (published 2026-07-20). Upstream backported the fixes to the 2.2 LTS and 2.10 branches only, so no patched 2.9.x release exists or will exist. Since Composer 2.9 the `audit.block-insecure` config defaults to true, which removes advisory-affected packages from the solver pool. Any build that resolves a `composer/composer` constraint pinned inside `~2.9.0` is now unsatisfiable — see mage-os#385 and the mirror integrity checks in mage-os/generate-mirror-repo-js, where all 18 jobs on the 2.9.8 entries fail with "not loaded, because they are affected by security advisories". Verified locally that magento/project-community-edition:2.4.9 resolves cleanly with Composer 2.10.2 (624 installs, composer/composer 2.10.2). The 2.2.28 entries are affected by the same advisories but do not fail, as `audit.block-insecure` does not exist on that branch; bumping those to 2.2.29 is left to a separate change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VwGN3wbp1cvWui4JeyXL4T
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #385.
Problem
Composer 2.9.8 is affected by three advisories published 2026-07-20:
<2.2.29,>=2.3.0 <2.10.2Upstream backported the fixes to the 2.2 LTS and 2.10 branches only, so there is no patched 2.9.x release and there will not be one — 2.9.8 is the last 2.9 release.
Since Composer 2.9 the
audit.block-insecureconfig defaults totrue, which strips advisory-affected packages out of the solver pool. Any build resolving acomposer/composerconstraint that sits entirely inside~2.9.0is therefore unsatisfiable:This is what breaks the mirror integrity checks in mage-os/generate-mirror-repo-js — all 18 jobs on the 2.9.8 matrix entries (2.4.7 → 2.4.9) fail, while the 2.2.28 ones pass.
COMPOSER_NO_AUDIT=1does not help: it only skips the post-install audit report, not the pool filter, and there is no env var forblock-insecure.Change
Bumps every
"composer": "2.9.8"matrix entry to"2.10.2"across both projects (18 + 5 for magento-open-source, 18 + 10 for mage-os) and rebuildsdist/. The Mage-OS 3.2.0 entries already declared 2.10.2, so this brings the rest in line.Verification
npm testpasses (114 tests). Resolution verified locally against https://mirror.mage-os.org/ withmagento/project-community-edition:2.4.9:composer/composer:~2.9.0→ unsatisfiable (reproduces the CI failure)composer/composer:~2.10.0→Lock file operations: 624 installs, 0 updates, 0 removals/Installing composer/composer (2.10.2)No other Magento dependency is currently advisory-blocked, so this alone unblocks the integrity checks.
Not included
The 52 + 5 entries on Composer 2.2.28 are affected by the same three advisories (patched in 2.2.29), but do not fail, because
audit.block-insecuredoes not exist on that branch. Bumping those is a separate, lower-urgency change.Longer term it may be worth setting
audit.block-insecure falsein the integrity-check installs over in generate-mirror-repo-js: that harness exists to reproduce Adobe's exact dependency tree, so refusing to install known-vulnerable versions is correct for a real store but wrong there — otherwise the next advisory landing on any Magento-pinned dependency breaks the mirror build again.🤖 Generated with Claude Code
https://claude.ai/code/session_01VwGN3wbp1cvWui4JeyXL4T