Merge branch 'composer:main' into main

.gitattributes

@@ -11,7 +11,7 @@
 # Exclude non-essential files from dist
 /.github/ export-ignore
 /doc export-ignore
-/phpstan/ export-ignore
+/phpstan/* export-ignore
 /tests/ export-ignore
 /.editorconfig export-ignore
 /.gitattributes export-ignore

.github/CONTRIBUTING.md

@@ -44,10 +44,6 @@ To achieve this, you need to acquire the Composer source code:
 You can run the test suite by executing `vendor/bin/simple-phpunit` when inside the
 composer directory, and run Composer by executing the `bin/composer`.
 
-For running the tests against the most recent PHP versions (PHP 8.0/8.1), you will
-need to run `composer update --ignore-platform-reqs && git checkout composer.lock`  before running 
-the `vendor/bin/simple-phpunit` command.
-
 To test your modified Composer code against another project, run
 `php /path/to/composer/bin/composer` inside that project's directory.
 

.github/workflows/continuous-integration.yml

@@ -30,6 +30,8 @@ jobs:
           - "7.4"
           - "8.0"
           - "8.1"
+          - "8.2"
+          - "8.3"
         dependencies: [locked]
         os: [ubuntu-latest]
         experimental: [false]
@@ -54,14 +56,14 @@ jobs:
             os: macos-latest
             dependencies: locked
             experimental: false
-          - php-version: "8.2"
+          - php-version: "8.3"
             dependencies: lowest-ignore
             os: ubuntu-latest
-            experimental: true
-          - php-version: "8.2"
+            experimental: false
+          - php-version: "8.3"
             dependencies: highest-ignore
             os: ubuntu-latest
-            experimental: true
+            experimental: false
 
     steps:
       - name: "Checkout"

CHANGELOG.md

@@ -1,8 +1,44 @@
+### [2.6.2] 2023-09-03
+
+  * Reverted "Fixed binary proxies causing scripts inspecting `$_SERVER['SCRIPT_NAME']` to detect them, they are now more transparent (#11562)" which caused a regression (#11617)
+  * Fixed non-zero exit code on failed audits to only apply to `install --audit` runs and not implicit audits with `require`, `create-project` or `update` commands (#11616)
+  * Fixed `create-project` infinite post-install loop in some circumstances (#11613)
+
+### [2.6.1] 2023-09-01
+
+  * Reverted "Fixed executability of non-php binaries which are not marked executable (#11557)" which caused a regression (#11612)
+
+### [2.6.0] 2023-09-01
+
+  * Added audit.ignore config setting to ignore security advisories by id or CVE id (#11556, #11605)
+  * Added `rm` alias to the `remove` command (#11367)
+  * Added runtime platform check to verify the php-64bit requirement is met (#11334)
+  * Added platform package detection for lib-pq-libpq and lib-rdkafka-librdkafka (#11418)
+  * Added `--dry-run` to `dump-autoload` command to allow running --strict-psr checks without modifying the filesystem (#11608)
+  * Added support for `bump`ing patch level in `~1.2.3` constraints (#11590)
+  * Added prompt in `require` if the package name is not found but similar ones exist (#11284)
+  * Added support for env vars and `~` in repository paths for vcs and artifact repositories (#11453)
+  * Added support for local directory paths for repositories of type `composer` (#11526)
+  * Added links to package homepages in `why`/`why-not` command output (#11308)
+  * Added a `security` key to the `support` key of composer.json to set the URL to the vulnerability disclosure policy (#11271)
+  * Added support for gathering security advisories from multiple repositories for a single package (#11436)
+  * Fixed `install` exit code to be non-zero (5) if a requested security audit failed (#11362)
+  * ~~Fixed binary proxies causing scripts inspecting `$_SERVER['SCRIPT_NAME']` to detect them, they are now more transparent (#11562)~~ (Reverted in 2.6.2)
+  * ~~Fixed executability of non-php binaries which are not marked executable (#11557)~~ (Reverted in 2.6.1)
+  * Fixed `mtime` modification of the vendor dir to only happen when packages are modified, and not require lock file modification to happen (#11593)
+  * Fixed `create-project` using the wrong composer.json file if one was set via the `COMPOSER` env var (#11493)
+  * Fixed json editing to preserve indentation when updating json files (#11390)
+  * Fixed handling of broken junctions on windows (#11550)
+  * Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
+  * Fixed svn repo parsing in some edge cases (#11350)
+  * Fixed handling of archive URLs without file extension (#11520)
+  * Performance improvement in pool optimization step (#11449, #11450)
+
 ### [2.5.8] 2023-06-09
 
   * Fixed regression in edge cases where root package gets added to a repository already during the install process (#11495)
   * Fixed EventDispatcher on windows picking bat files when using "@php binary" (#11490)
-  * Fixed ICU CDLR version parsing failing the whole process when ICU cannot initialize the resource bundle (#11492)
+  * Fixed ICU CLDR version parsing failing the whole process when ICU cannot initialize the resource bundle (#11492)
   * Fixed type declarations on ClassLoader (#11500)
 
 ### [2.5.7] 2023-05-24
@@ -254,7 +290,7 @@
   * Added abandoned flag to `show`/`outdated` commands JSON-formatted output (#10485)
   * Added config.reference option to `path` repositories to configure the way the reference is generated, and possibly reduce composer.lock conflicts (#10488)
   * Added automatic removal of allow-plugins rules when removing a plugin via the `remove` command (#10615)
-  * Added COMPOSER_IGNORE_PLATFOR_REQ & COMPOSER_IGNORE_PLATFOR_REQS env vars to configure the equivalent flags (#10616)
+  * Added `COMPOSER_IGNORE_PLATFORM_REQ` & `COMPOSER_IGNORE_PLATFORM_REQS` env vars to configure the equivalent flags (#10616)
   * Added support for Symfony 6.0 components
   * Added support for psr/log 3.x (#10454)
   * Fixed symlink creation in linux VM guest filesystems to be recognized by Windows (#10592)
@@ -1731,6 +1767,9 @@
 
   * Initial release
 
+[2.6.2]: https://github.com/composer/composer/compare/2.6.1...2.6.2
+[2.6.1]: https://github.com/composer/composer/compare/2.6.0...2.6.1
+[2.6.0]: https://github.com/composer/composer/compare/2.5.8...2.6.0
 [2.5.8]: https://github.com/composer/composer/compare/2.5.7...2.5.8
 [2.5.7]: https://github.com/composer/composer/compare/2.5.6...2.5.7
 [2.5.6]: https://github.com/composer/composer/compare/2.5.5...2.5.6

composer.json

@@ -37,7 +37,7 @@
         "symfony/filesystem": "^5.4 || ^6.0 || ^7",
         "symfony/finder": "^5.4 || ^6.0 || ^7",
         "symfony/process": "^5.4 || ^6.0 || ^7",
-        "react/promise": "^2.8",
+        "react/promise": "^2.8 || ^3",
         "composer/pcre": "^2.1 || ^3.1",
         "symfony/polyfill-php73": "^1.24",
         "symfony/polyfill-php80": "^1.24",