[pkg-php-pear] composer_2.11.0~rc1-1_source.changes ACCEPTED into experimental

Fri Oct 23 14:08:02 BST 2026

Thank you for your contribution to Debian.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 23 Oct 2026 11:27:46 +0200
Source: composer
Architecture: source
Version: 2.11.0~rc1-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear at lists.alioth.debian.org>
Changed-By: David Prévot <taffit at debian.org>
Changes:
 composer (2.11.0~rc1-1) experimental; urgency=medium
 .
   * Upload RC to experimental
 .
   [ Jordi Boggiano ]
   * Add batching to the security advisories API queries for projects with very
     large dep count (#13051)
   * Add installed version to sub-dependencies in show --tree JSON output
     (#13049)
   * Load more classes pre-emptively before swapping the phar file, fixes #13079
   * Warn about paths only differing in casing in optimized autoload dumps
     (#13085)
   * Pass along agent name as well as agent (#13087)
   * Bump plugin API version to 2.11
   * Remove source-fallback option that was added in 2.10 as a stop-gap measure
     (#13050)
   * Fix clear-cache --no-cache reporting missing dirs instead of disabled cache
     (#13092)
   * Retry downloads of truncated zip archives (#13094)
   * Escape package controlled data interpolated into the generated bin proxies
     (#13056)
   * Stop requesting HTTP/3, as hosts Composer talks to do not support it yet
     (#13096)
   * Track why policies removed each version in one map on the pool (#13100)
   * Parse package release/published dates lazily (#13103)
   * Load package metadata in parallel before outdated/show --latest lookups
     (#13113)
   * Make outdated and show --latest respect the cooldown policy (#13102)
   * Bump >=10 style lower bounds without loosening OR constraints (#13133)
   * Bump minimum required justinrainbow/json-schema
   * Count authentication retries separately from network retries (#13135)
   * Fix repository transport options matching dist URLs on other hosts (#13142)
   * Fix secure-http check skipping malformed URLs and git transport prefixes
     (#13144)
   * Avoid warnings when finding packages within inline packages without uid
     (#13148)
   * Reject TLS connections presenting distrusted intermediate certificates
     (#13146)
   * Make sure the policy config is reflected in the lock file (#13149)
   * Add --no-cooldown flag to update/require/remove/create-project (#13153)
   * Update changelog
   * Release 2.11.0-RC1
 .
   [ Greg Roach ]
   * Fix: an empty command in a script should always be a NO-OP (#13053)
 .
   [ Pascal CESCON ]
   * Report the GitHub API rate limit when the clone fallback fails (#13059)
 .
   [ Markus Staab ]
   * Move getVersion() call out of loop (#13123)
   * RuleWatchGraph: Reduce getRule() calls (#13124)
   * Solver: Call getLiterals() only for enabled rules (#13132)
 .
   [ Eirik Stanghelle Morland ]
   * Support retrying requests honoring their retry-after header (#13082)
   * Send AI agent info as part of user agent (#13073)
 .
   [ Nicolas Grekas ]
   * Replace generated files instead of rewriting them in place (#13069)
 .
   [ Yanick Witschi ]
   * Reuse version lists within pool optimizer package groups (#13072)
   * Avoid repeated invariant constraint checks in pool optimization (#13071)
   * Add terminal program status reporting via OSC (#13117)
 .
   [ Samran Asif ]
   * Url: preserve SSH user in stripCredentials() (#13081)
 .
   [ Lazizbek Ergashev ]
   * Skip loading security advisories for named dev branches' packages in the
     pool filter (#13089)
 .
   [ MD Ali Kadar ]
   * Share the repeated warning dedup across all outputWarnings() callers
     (#13090)
 .
   [ Ben Younes ]
   * Exclude the vendor dir from root classmap scanning (#13018)
   * Fix suggest filtering for non-installed packages (#12992) (#13014)
 .
   [ Nicholas Ciechanowski ]
   * feat: add `strict-psr-autoloader` to options (#12893)
 .
   [ Alessandro Lai ]
   * Fix handling of GitLab CI job token auth (#12916)
 .
   [ Stephan ]
   * Custom policies: add block-scope config option to block during composer
     install (#12990)
 .
   [ Viktor Djupsjöbacka ]
   * Add cooldown policy config to filter newly released packages (#12692)
 .
   [ Tony Nguyen ]
   * Fail install when composer.lock has a content-hash merge conflict (#13105)
 .
   [ kevin ]
   * Fix JsonManipulator::addSubNode modifying a nested key with the same name
     (#13109)
 .
   [ Daler Azimov ]
   * Fix wildcard package updates with --minimal-changes (#13118)
 .
   [ Nguyen Quang Truong ]
   * Explain advisory-blocked versions in dependency conflicts (#13108)
 .
   [ PrinsFrank ]
   * Ask user if the composer.lock should be added to .gitattributes with
     export-ignore when initializing a library (#13127)
 .
   [ Bram Driesen ]
   * feat: Add support for -D (direct) in audit command (#13121)
 .
   [ qodelicious ]
   * Merge custom-headers from all config sources (#13141)
 .
   [ hershel-theodore-layton ]
   * Check plugin capability correctness before instantiating it (#13139)
 .
   [ Daniel Pinto ]
   * Treat packages with no installable version as up to date in outdated
     (#13138)
 .
   [ Soner ]
   * Add only-branches option to VCS repositories (#13086)
 .
   [ Adel Kaleche ]
   * Explain security-blocked versions with partial advisories instead of failing
     (#13075)
 .
   [ Maciej Pawłowski ]
   * Support Bitbucket Cloud’s new SSH hostname (#13152)
 .
   [ David Prévot ]
   * Document CVE in previous changelog entry
Checksums-Sha1:
 5dacb9fe941999c5b2ef13b5eea21c5e0fae9d60 2662 composer_2.11.0~rc1-1.dsc
 b62f8678faf60571a50eaff565d7a7e9882ecbb5 853232 composer_2.11.0~rc1.orig.tar.xz
 bbb0c29c5cd5309f967ab6a2a9924e39aad54b27 65048 composer_2.11.0~rc1-1.debian.tar.xz
 c317ebc51d5b3367015731864460ae80f01629a2 9858 composer_2.11.0~rc1-1_amd64.buildinfo
Checksums-Sha256:
 91c25afba1fd80733eaf8ef083676b072ecb828afdf461789ff9c67eaba90168 2662 composer_2.11.0~rc1-1.dsc
 ea3e6b949ce5fa46d44ca3d46323376ec476ed8f7ee26588639a6519ebc2c0f8 853232 composer_2.11.0~rc1.orig.tar.xz
 51d134d68a91d1281bf8cb69187a9fe49e72330842eaf81c926c2910aad5216d 65048 composer_2.11.0~rc1-1.debian.tar.xz
 2a8531ed593f69afee7482e8897fd59a881617a8b3fdc6ec56d1e7ad62334e17 9858 composer_2.11.0~rc1-1_amd64.buildinfo
Files:
 d41f15270afa92f6ffc50baf085351f6 2662 php optional composer_2.11.0~rc1-1.dsc
 dd5ef11187f0271191ab36e1303da414 853232 php optional composer_2.11.0~rc1.orig.tar.xz
 642103264f81542a8a9b749b2b6e3065 65048 php optional composer_2.11.0~rc1-1.debian.tar.xz
 8a3cc948c7a0f1943c131d9169358345 9858 php optional composer_2.11.0~rc1-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErhStAUJtK/uC734euCohev3+CfIFAmrbVtAACgkQuCohev3+
CfLqRw//XKS5Ucg/1UEkSpKfEQdLc7V13Ks9d3c1pNUoF7qOz05zy9akAWCfIZW4
4/6yqLy/ZIp6njGfTW/1BGILJcDalVP4hImmYn+ny3G4Dax310Yct2YYPDtiXefi
eVv8SLMUGZul4q18yUY+NZqAxf5HnWWvP7G5+Un+3MPwwt/Wnlxf9TivDRDCgBGr
UEPjHrvLgj0g1nSTrqZcz5kyHpLkJVgHZ+Ad8uQTW8YUvOp2qSspN3rJ4DkTbhVi
WG7iWV99GYPrj8s8cIUkZD/Azypboa14DiTVUwDlFpPyli3lLyr2R1io3N7c674f
93O/AN89G5CnMnvO2+fQahGuXvO3laaq9uu4GL/DRznvYDvkvx/2LgHGiCjRkqNy
ahOeE8PoezrFsmtkabDNDRgmNIIg1RJwM4XHytOPj9gIURdO0hunVMiE1xBXwaku
8Y69S1XtziUN1zPBmqvVS7qD1xWiMnUbawzpNda2M9bzOc3Zs45PouuudUBAb0j3
KYSkLT+HwW1ilRst5JJdX02rSTN4QbfG8jJxEsDXUaBtuG/TUZgEfWAZa56oNxRL
QioFI5kyGghE5CzvXqRz7L6xIaJ6Gw7waeMCOs9xLfPYuFZV+dvWxH3kslD/aMzk
WuyxfZXt7HTnZ1bHy4/MLdbCWiNJeVcSXA3+a3OrcrtffdtgM6Q=
=M+jQ
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-php-pear/attachments/20261023/7438617c/attachment-0001.sig>