Composer 2.9 Introduces Security Improvements and New Repository Tools

A key new feature is automatic security blocking. Composer now prevents package updates that include known vulnerabilities, using advisory data by default. This behavior can be configured using the audit.block-insecure setting. Developers can also block abandoned packages via audit.block-abandoned, though it is disabled by default. This replaces the need for the roave/security-advisories package.

The update also introduces a new composer repo command, which allows users to list, add, remove, or update repositories directly from the command line. Repositories are now stored as a JSON array, improving readability and structure. Examples include composer repo add, composer repo remove, and composer repo set-url.

Composer 2.9 supports automatic recovery from simple lock file conflicts. When only the content-hash is in conflict, running composer update --lock or re-applying the update allows the tool to resolve conflicts automatically.

Additional improvements include a --minimal-changes flag for constrained updates, native support for Forgejo repositories, reduced autoloader overhead in scripts, and support for HTTP/3.

The full list of changes is available in the Composer 2.9 changelog.