composer

• Added support for new pie download-url-methods (#12727)
• Fixed detection of 7z when installed as 7za on some linux systems (#12731)
• Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already

Full Changelog: https://github.com/composer/composer/compare/2.9.4...2.9.5

• Added active plugins to the diagnose command output (#12706)
  • Fixed HTTP/3 causing issues with proxies (#12699)
  • Fixed show command regression with long descriptions containing unicode characters (#12704)
  • Fixed regression handling invalid unicode sequences in output (#12707)
  • Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
  • Fixed issue handl...

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
  • Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
  • Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
  • Fixed `client...

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)

Full Changelog: https://github.com/composer/composer/compare/2.2.25...2.2.26

• Added new --no-security-blocking flag to disable/configure security blocking (#12617)
  • Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
  • Fixed config command not being able to set the new audit settings (#12609)
  • Fixed handling audit.ignore to sup...