search

pierobot / mangapie

This is a self-hosted server for archived manga.
BSD 3-Clause "New" or "Revised" License
63 stars 9 forks source link

Bump composer/composer from 2.0.8 to 2.2.12 #254

Open dependabot[bot] opened 2 years ago

dependabot[bot] commented 2 years ago

Bumps composer/composer from 2.0.8 to 2.2.12.

Release notes

Sourced from composer/composer's releases.

2.2.12

  • Security: Fixed command injection vulnerability in HgDriver/GitDriver (GHSA-x7cr-6qr6-2hh6 / CVE-2022-24828)
  • Fixed curl downloader not retrying when a DNS resolution failure occurs (#10716)
  • Fixed composer.lock file still being used/read when the lock config option is disabled (#10726)
  • Fixed validate command checking the lock file even if the lock option is disabled (#10723)

2.2.11

  • Added missing config.bitbucket-oauth in composer-schema.json
  • Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
  • Updated semver, jsonlint deps for minor fixes
  • Fixed generation of autoload crashing if a package has a broken path (#10688)
  • Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and extracting dev deps (#10651)

2.2.10

  • Fixed Bitbucket authorization detection due to API changes (#10657)
  • Fixed validate command warning about dist/source keys if defined (#10655)
  • Fixed deletion/handling of corrupted 0-bytes zip archives (#10666)

2.2.9

  • Fixed regression with plugins that modify install path of packages, see docs if you are authoring such a plugin (#10621)

2.2.8

  • Fixed files autoloading sort order to be fully deterministic (#10617)
  • Fixed pool optimization pass edge cases (#10579)
  • Fixed require command failing when self.version is used as constraint (#10593)
  • Fixed --no-ansi / undecorated output still showing color in repo warnings (#10601)
  • Performance improvement in pool optimization step (composer/semver#131)

2.2.7

  • Allow installation together with composer/xdebug-handler ^3 (#10528)
  • Fixed support for packages with no licenses in licenses command output (#10537)
  • Fixed handling of allow-plugins: false which kept warning (#10530)
  • Fixed enum parsing in classmap generation when the enum keyword is not lowercased (#10521)
  • Fixed author parsing in init command requiring an email whereas the schema allows a name only (#10538)
  • Fixed issues in require command when requiring packages which do not exist (but are provided by something else you require) (#10541)
  • Performance improvement in pool optimization step (#10546)

2.2.6

  • BC Break: due to an oversight, the COMPOSER_BIN_DIR env var for binaries added in Composer 2.2.2 had to be renamed to COMPOSER_RUNTIME_BIN_DIR (#10512)
  • Fixed enum parsing in classmap generation with syntax like enum foo:string without space after : (#10498)
  • Fixed package search not urlencoding the input (#10500)
  • Fixed reinstall command not firing pre-install-cmd/post-install-cmd events (#10514)
  • Fixed edge case in path repositories where a symlink: true option would be ignored on old Windows and old PHP combos (#10482)
  • Fixed test suite compatibility with latest symfony/console releases (#10499)
  • Fixed some error reporting edge cases (#10484, #10451, #10493)

2.2.5

  • Disabled composer/package-versions-deprecated by default as it can function using Composer\InstalledVersions at runtime (#10458)
  • Fixed artifact repositories crashing if a phar file was present in the directory (#10406)
  • Fixed binary proxy issue on PHP <8 when fseek is used on the proxied binary path (#10468)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.2.12] 2022-04-13

  • Security: Fixed command injection vulnerability in HgDriver/GitDriver (GHSA-x7cr-6qr6-2hh6 / CVE-2022-24828)
  • Fixed curl downloader not retrying when a DNS resolution failure occurs (#10716)
  • Fixed composer.lock file still being used/read when the lock config option is disabled (#10726)
  • Fixed validate command checking the lock file even if the lock option is disabled (#10723)

[2.2.11] 2022-04-01

  • Added missing config.bitbucket-oauth in composer-schema.json
  • Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
  • Updated semver, jsonlint deps for minor fixes
  • Fixed generation of autoload crashing if a package has a broken path (#10688)
  • Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and extracting dev deps (#10651)

[2.2.10] 2022-03-29

  • Fixed Bitbucket authorization detection due to API changes (#10657)
  • Fixed validate command warning about dist/source keys if defined (#10655)
  • Fixed deletion/handling of corrupted 0-bytes zip archives (#10666)

[2.2.9] 2022-03-15

  • Fixed regression with plugins that modify install path of packages, see docs if you are authoring such a plugin (#10621)

[2.2.8] 2022-03-15

  • Fixed files autoloading sort order to be fully deterministic (#10617)
  • Fixed pool optimization pass edge cases (#10579)
  • Fixed require command failing when self.version is used as constraint (#10593)
  • Fixed --no-ansi / undecorated output still showing color in repo warnings (#10601)
  • Performance improvement in pool optimization step (composer/semver#131)

[2.2.7] 2022-02-25

  • Allow installation together with composer/xdebug-handler ^3 (#10528)
  • Fixed support for packages with no licenses in licenses command output (#10537)
  • Fixed handling of allow-plugins: false which kept warning (#10530)
  • Fixed enum parsing in classmap generation when the enum keyword is not lowercased (#10521)
  • Fixed author parsing in init command requiring an email whereas the schema allows a name only (#10538)
  • Fixed issues in require command when requiring packages which do not exist (but are provided by something else you require) (#10541)
  • Performance improvement in pool optimization step (#10546)

[2.2.6] 2022-02-04

  • BC Break: due to an oversight, the COMPOSER_BIN_DIR env var for binaries added in Composer 2.2.2 had to be renamed to COMPOSER_RUNTIME_BIN_DIR (#10512)
  • Fixed enum parsing in classmap generation with syntax like enum foo:string without space after : (#10498)
  • Fixed package search not urlencoding the input (#10500)
  • Fixed reinstall command not firing pre-install-cmd/post-install-cmd events (#10514)
  • Fixed edge case in path repositories where a symlink: true option would be ignored on old Windows and old PHP combos (#10482)

... (truncated)

Commits
  • ba61e76 Release 2.2.12
  • a1f9baa Fix 5.3/5.4 builds
  • 2ba8758 Update changelog
  • 2c40c53 Merge pull request from GHSA-x7cr-6qr6-2hh6
  • 915b97f Fix docs
  • d64e32c Merge remote-tracking branch 'ktomk/patch-validate-no-check-lock' into 2.2
  • 0a8dfe6 Clarify that autoloader-suffix should be a non-empty-string, fixes #10720 (#1...
  • bb0edce Fixed lock file being used when lock:false is in config, refs #10715 (#10726)
  • 939c998 validate lock-file if configured (#10715, --check-lock)
  • 9bfd059 Fix curl downloader to retry in case of DNS resolution failure, fixes #10716
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pierobot/mangapie/network/alerts).