The Composer CLI is part of your supply chain. Older versions miss the protections in 2.10 and carry known CVEs of their own.
Private Packagist customers can now enforce which Composer client versions can talk to their repository.
#php #phpc #composerphp
PHP / Composer / Drupal, beer nerd and JavaScript fan. I also maintain the PHP update service violinist.io


