Bump composer/composer from 2.10.1 to 2.10.3

[dependabot]

Bumps composer/composer from 2.10.1 to 2.10.3.

Release notes

Sourced from composer/composer's releases.

2.10.3

• Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
• Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
• Security: Sanitize URL-embedded usernames/token in a few more places (#13044)
• Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
• Fixed PHP 8.6 deprecation warnings (#12967, #13028)
• Fixed error output when a policy blocks a package version to be clearer (#12993)
• Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
• Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)
• Fixed forgejo support to handle empty repositories better (#12968)
• Fixed FilterListApiClient not forwarding transport options (#13040)

Full Changelog: composer/composer@2.10.2...2.10.3

2.10.2

• Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Full Changelog: composer/composer@2.10.1...2.10.2

Changelog

Sourced from composer/composer's changelog.

[2.10.3] 2026-08-27

• Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
• Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
• Security: Sanitize URL-embedded usernames/token in a few more places (#13044)
• Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
• Fixed PHP 8.6 deprecation warnings (#12967, #13028)
• Fixed error output when a policy blocks a package version to be clearer (#12993)
• Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
• Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)
• Fixed forgejo support to handle empty repositories better (#12968)
• Fixed FilterListApiClient not forwarding transport options (#13040)

[2.10.2] 2026-07-01

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Commits

• f0de0bf Release 2.10.3
• f247758 Update changelog
• 0aac505 Merge commit from fork
• 53b8bb4 Merge commit from fork
• 24e396b Make it possible to pass transport options to FilterListApiClient (#13040)
• f383d23 Do not use a conflicted content-hash as the autoloader suffix (#13048)
• ada0055 Mask URL credentials anywhere in a string, not just at its start (#13044)
• cd19785 Prevent curl SSL version parsing across lines (#13046)
• eba7baa Fix Url::getOrigin prefix-matching a host against gitlab-domains (#12988)
• 5e9f655 Include the failed URL in max-file-size and content-length errors (#13041)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)