Bump composer/composer from 2.2.12 to 2.2.23

[dependabot]

Bumps composer/composer from 2.2.12 to 2.2.23.

Release notes

Sourced from composer/composer's releases.

2.2.23

• Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)

2.2.22

• Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
• Fixed authentication issue when downloading several files from private Bitbucket in parallel (#11464)
• Fixed handling of broken junctions on windows (#11550)
• Fixed loading of root aliases on path repo packages when doing partial updates (#11632)
• Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
• Fixed binary proxies not being transparent when included by another PHP process and returning a value (#11454)
• Fixed support for plugin classes being marked as readonly (#11404)
• Fixed GitHub rate limit reporting (#11366)
• Fixed issue displaying solver problems with branch names containing % signs (#11359)

2.2.21

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

2.2.20

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

2.2.19

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

2.2.18

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being displayed (#10938)
• Fixed hg version detection (#10955)
• Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given reference (#11004)

2.2.17

PSA: If you are seeing issues running non-interactive create-project with a project that does not configure allow-plugins, see the top post of #10928 for a workaround.

• Fixed plugins from CWD/vendor being loaded in some cases like create-project or validate even though the target directory is outside of CWD (#10935)
• Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo) plugins which will not warn/error anymore if not in allow-plugins, as they are anyway not loaded (#10928)
• Fixed pre-install check for allowed plugins not taking --no-plugins into account (#10925)
• Fixed support for disable_functions containing disk_free_space (#10936)
• Fixed RootPackageRepository usages to always clone the root package to avoid interoperability issues with plugins (#10940)

2.2.16

• Fixed non-interactive behavior of allow-plugins to throw instead of continue with a warning to avoid broken installs (#10920)
• Fixed allow-plugins BC mode to ensure old lock files created pre-2.2 can be installed with only a warning but plugins fully loaded (#10920)
• Fixed deprecation notice (#10921)

2.2.15

• Fixed support for cache-read-only where the filesystem is not writable (#10906)
• Fixed type error when using allow-plugins: true (#10909)
• Fixed @​putenv scripts receiving arguments passed to the command (#10846)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.7.6] 2024-05-04

• Fixed regression when script handlers add an autoloader which uses a private callback (#11960)

[2.7.5] 2024-05-03

• Added uninstall alias to remove command (#11951)
• Added workaround for broken curl versions 8.7.0/8.7.1 causing transport exceptions (#11913)
• Fixed root usage warnings showing up within Podman containers (#11946)
• Fixed config command not handling objects correctly in some conditions (#11945)
• Fixed binary proxies not containing the correct path if the project dir is a symlink (#11947)
• Fixed Composer autoloader being overruled by project autoloaders when they are loaded by event handlers (scripts/plugins) (#11955)
• Fixed TransportException (http failures) not having a distinct exit code, should now exit with 100 as code (#11954)

[2.7.4] 2024-04-22

• Fixed regression (Call to undefined method ProxyManager::needsTransitionWarning()) with projects requiring composer/composer in an pre-2.7.3 version (#11943, #11940)

[2.7.3] 2024-04-19

• BC Warning: Fixed https_proxy env var falling back to http_proxy's value, this is still in place but with a warning for now, and https_proxy can now be set empty to remove the fallback. Composer 2.8.0 will remove the fallback so make sure you heed the warnings (#11915)
• Fixed show and outdated commands to remove leading v in e.g. v1.2.3 when showing lists of packages (#11925)
• Fixed audit command not showing any id when no CVE is present, the advisory ID is now shown (#11892)
• Fixed the warning about a missing default version showing for packages with project type as those are typically not versioned and do not have cyclic dependencies (#11885)
• Fixed PHP 8.4 deprecation warnings
• Fixed clear-cache command to respect the config.cache-dir setting from the local composer.json (#11921)
• Fixed status command not handling failed download/install promises correctly (#11889)
• Added support for buy_me_a_coffee in GitHub funding files (#11902)
• Added hg support for SSH urls (#11878)
• Fixed some env vars with an integer value causing a crash (#11908)
• Fixed context data not being output when using IOInterface as a PSR-3 logger (#11882)

[2.7.2] 2024-03-11

• Added info about the PHP version when running composer --version (#11866)
• Added warning when the root version cannot be detected (#11858)
• Fixed plugins still being enabled in a few contexts when running as root (c3efff91f)
• Fixed outdated --ignore ... still attempting to load the latest version of the ignored packages (#11863)
• Fixed handling of broken symlinks in the middle of an install path (#11864)
• Fixed update --lock still incorrectly updating some metadata (#11850, #11787)

[2.7.1] 2024-02-09

• Added several warnings when plugins are disabled to hint at common problems people had with 2.7.0 (#11842)
• Fixed diagnose auditing of Composer dependencies failing when running from the phar

[2.7.0] 2024-02-08

• Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)
• Changed the default of the audit.abandoned config setting to fail, set it to report or ignore if you do not want this, or set it via COMPOSER_AUDIT_ABANDONED env var (#11643)

... (truncated)

Commits

• d1542e8 Release 2.2.23
• ff14762 Fix php5.3 syntax
• 6263586 Remove php8 CI
• b534407 Remove platform config before selecting phpunit bridge version
• 69fa55d CI fixes
• 7418b52 Remove return type
• 77e3982 Merge pull request from GHSA-7c6p-848j-wh5h
• c6e09b3 Update deps
• 6a69018 Reverting release version changes
• fedc76e Release 2.2.22
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.