Problem/Motivation

Composer has released another security update, 2.9.8.

Proposed resolution

Increase the lockfile and metapackage version of Composer on all branches.

Remaining tasks

MRs needed for main down through 10.5.

Release notes snippet

Composer is updated to version 2.9.8.

Issue fork drupal-3590423

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm opened merge request !15775

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review

xjm opened merge request !15776

xjm opened merge request !15777

xjm opened merge request !15778

xjm opened merge request !15779

xjm opened merge request !15780

xjm’s picture

xjm
she/her
Primary language English
commented

This can be committed to main and 11.x whenever RTBC, but we can hold off on committing the backports for now.

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Needs review » Reviewed & tested by the community

Looks good to me.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Version: main » 11.3.x-dev

Committed 3975678 and pushed to main. Thanks!
Committed 5c4bdfe and pushed to 11.x. Thanks!

  • alexpott committed 5c4bdfe0 on 11.x 
    task: #3590423 Update Composer to 2.9.8

By: xjm

  • alexpott committed 39756780 on main 
    task: #3590423 Update Composer to 2.9.8

By: xjm
xjm’s picture

xjm
she/her
Primary language English
commented
Version: 11.3.x-dev » 10.5.x-dev
Status: Reviewed & tested by the community » Fixed

Fixed today in the release branches as part of the releases for SA-CORE-2026-004. Thanks everyone!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

xjm closed merge request !15780

xjm closed merge request !15779

xjm closed merge request !15778

xjm closed merge request !15777

xjm closed merge request !15776

xjm closed merge request !15775

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.