Composer 2.7: minimal changes and a security wake-up call
Released on 8 February 2024, Composer 2.7 combined genuinely useful dependency controls with a high-priority security fix.
Composer 2.7 is a good example of a release where the operational context matters as much as the feature list. It shipped alongside a fix for a code execution and privilege-escalation vulnerability, which made the upgrade immediately important for a large part of the PHP ecosystem.
Beyond the security fix, the most useful additions were the new `--minimal-changes` flag for safer partial dependency updates, `--sort-by-age` for outdated packages, richer audit output, and better diagnostics around package age and token state.
That mix makes 2.7 one of the more consequential Composer releases in recent years. It improved both the safety of the tool itself and the discipline of the workflows around it.