Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
https://blog.packagist.com/composer-2-7-7/
Proposed resolution
Require Composer 2.7.7 for 10.3.x and above in Drupal's dev dependencies (and for Autoupdates).
Remaining tasks
NR. Branch named -composer is the 11.x version (sorry); others are named according to their target branch.
Release notes snippet
Drupal core's Composer development dependency has been updated to Composer 2.7.7, which addresses security vulnerabilities. It is recommended that Drupal site owners also update their local Composer versions with composer self-update.
| Comment | File | Size | Author |
|---|
Issue fork drupal-3454556
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #4
xjmComment #7
xjmComment #8
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.
Comment #9
xjmComment #10
xjmComment #11
xjmComment #12
smustgrave commentedAll MRs are green
Didn't test on every version but on 11.x applied the MR and self-update worked as expected.
Comment #20
catchCommitted/pushed to 11.x, 11.0.x, 10.4.x, 10.3.x respectively, thanks! Added the release notes snippet to the 10.3.0 draft.