Post

Packagist
@packagist.com

🚨 Security advisory: Composer 2.9.8 and 2.2.28 fix a vulnerability leaking GitHub Actions GITHUB_TOKENs to job logs via error messages. Update now or disable affected workflows. blog.packagist.com/composer-2-9... #composerphp #phpc #php

blog.packagist.comComposer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messagesPlease immediately update Composer to version 2.9.8 or 2.2.28 (LTS) by running composer.phar self-update. The new releases fix a vulnerability where Composer leaks the full contents of GitHub Actions ...

8 reposts7 likes

Packagist
@packagist.com

UPDATE: GitHub has rolled back their change to GitHub Actions tokens, no longer necessary to immediately disable GitHub Actions. We now have a few days to get the PHP ecosystem updated to safe Composer versions, before a new rollout of the new token format is attempted. #php #composerphp #phpc