Composer 2.9: security blocking and saner repository management
Released on 13 November 2025, Composer 2.9 pushed more supply-chain protection into the default dependency workflow.
Composer 2.9 is a release that reads like maintainers finally codifying the rules disciplined teams were already trying to enforce themselves.
The two biggest additions are automatic blocking of insecure package updates and the new `repository` command for managing repositories directly from the CLI. It also adds minimal-change improvements, better lock-file conflict recovery, Forgejo support, HTTP/3 support, and performance improvements in script handling.
That matters because Composer is not just a package installer anymore. In mature PHP teams it is part of the security boundary, and 2.9 moves that boundary in the right direction.