From eea73daeacfaac96877bc8df354913fc8958be02 Mon Sep 17 00:00:00 2001 From: Jordi Boggiano Date: Thu, 8 Feb 2024 14:34:27 +0100 Subject: [PATCH] Update changelog --- CHANGELOG.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 819b3f822..13e177cbc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,32 @@ +### [2.7.0] 2024-02-08 + + * Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821) + * Changed the default of the `audit.abandoned` config setting to `fail`, set it to `report` or `ignore` if you do not want this, or set it via `COMPOSER_AUDIT_ABANDONED` env var (#11643) + * Added --minimal-changes (-m) flag to `update`/`require`/`remove` commands to perform partial update with --with-dependencies while changing only what is absolutely necessary in transitive dependencies (#11665) + * Added --sort-by-age (-A) flag to `outdated`/`show` commands to allow sorting by and displaying the release date (most outdated first) (#11762) + * Added support for `--self` combined with `--installed` or `--locked` in `show` command, to add the root package to the package list being output (#11785) + * Added severity information to `audit` command output (#11702) + * Added `scripts-aliases` top level key in composer.json to define aliases for custom scripts you defined (#11666) + * Added IPv4 fallback on connection timeout, as well as a `COMPOSER_IPRESOLVE` env var to force IPv4 or IPv6, set it to `4` or `6` (#11791) + * Added support for wildcards in `outdated`'s --ignore arg (#11831) + * Added support for `bump` command bumping `*` to `>=current version` (#11694) + * Added detection of constraints that cannot possibly match anything to `validate` command (#11829) + * Added package source information to the output of `install` when running in very verbose (-vv) mode (#11763) + * Added audit of Composer's own bundled dependencies in `diagnose` command (#11761) + * Added GitHub token expiration date to `diagnose` command output (#11688) + * Added non-zero status code to why/why-not commands (#11796) + * Added error when calling `show --direct ` with an indirect/transitive dependency (#11728) + * Added `COMPOSER_FUND=0` env var to hide calls for funding (#11779) + * Fixed `bump` command not bumping packages required with a `v` prefix (#11764) + * Fixed automatic disabling of plugins when running non-interactive as root + * Fixed `update --lock` not keeping the dist reference/url/checksum pinned (#11787) + * Fixed `require` command crashing at the end if no lock file is present (#11814) + * Fixed root aliases causing problems when auditing locked dependencies (#11771) + * Fixed handling of versions with 4 components in `require` command (#11716) + * Fixed compatibility issues with Symfony 7 + * Fixed composer.json remaining behind after a --dry-run of the `require` command (#11747) + * Fixed warnings being shown incorrectly under some circumstances (#11786, #11760, #11803) + ### [2.6.6] 2023-12-08 * Fixed symfony/console requirement to exclude 7.x as Composer 2.6 is not compatible, 2.7 will be (#11741) @@ -1795,6 +1824,7 @@ * Initial release +[2.7.0]: https://github.com/composer/composer/compare/2.6.6...2.7.0 [2.6.6]: https://github.com/composer/composer/compare/2.6.5...2.6.6 [2.6.5]: https://github.com/composer/composer/compare/2.6.4...2.6.5 [2.6.4]: https://github.com/composer/composer/compare/2.6.3...2.6.4