Bump composer/composer from 2.0.13 to 2.1.12

[dependabot]

Bumps composer/composer from 2.0.13 to 2.1.12.

Release notes

Sourced from composer/composer's releases.

2.1.12

• Fixed issues in proxied binary files relying on __FILE__ / __DIR__ on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

2.1.11

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

2.1.10

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

2.1.9

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

2.1.8

• Fixed regression in 2.1.7 when parsing classmaps in files containing invalid Unicode (#10102)

2.1.7

• Added many type annotations internally, which may have an effect on CI/static analysis for people using Composer as a dependency. This work will continue in following releases
• Fixed regression in 2.1.6 when parsing classmaps with empty heredocs (#10067)
• Fixed regression in 2.1.6 where list command was not showing plugin commands (#10075)
• Fixed issue handling package updates where the package type changed (#10076)
• Fixed docker being detected as WSL when run inside WSL (#10094)

2.1.6

• Updated internal PHAR signatures to be SHA512 instead of SHA1
• Fixed uncaught exception handler regression (#10022)
• Fixed more PHP 8.1 deprecation warnings (#10036, #10038, #10061)
• Fixed corrupted zips in the cache from blocking installs until a cache clear, the bad archives are now deleted automatically on first failure (#10028)
• Fixed URL sanitizer handling of new github tokens (#10048)
• Fixed issue finding classes with very long heredocs in classmap autoload (#10050)
• Fixed proc_open being required for simple installs from zip, as well as diagnose (#9253)
• Fixed path repository bug causing symlinks to be left behind after a package is uninstalled (#10023)
• Fixed issue in 7-zip support on windows with certain archives (#10058)
• Fixed bootstrapping process to avoid loading the composer.json and plugins until necessary, speeding things up slightly (#10064)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.1.12] 2021-11-09

• Fixed issues in proxied binary files relying on FILE / DIR on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

[2.1.11] 2021-11-02

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

[2.1.10] 2021-10-29

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

[2.1.9] 2021-10-05

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

[2.1.8] 2021-09-15

• Fixed regression in 2.1.7 when parsing classmaps in files containing invalid Unicode (#10102)

[2.1.7] 2021-09-14

• Added many type annotations internally, which may have an effect on CI/static analysis for people using Composer as a dependency. This work will continue in following releases
• Fixed regression in 2.1.6 when parsing classmaps with empty heredocs (#10067)
• Fixed regression in 2.1.6 where list command was not showing plugin commands (#10075)
• Fixed issue handling package updates where the package type changed (#10076)
• Fixed docker being detected as WSL when run inside WSL (#10094)

[2.1.6] 2021-08-19

• Updated internal PHAR signatures to be SHA512 instead of SHA1
• Fixed uncaught exception handler regression (#10022)
• Fixed more PHP 8.1 deprecation warnings (#10036, #10038, #10061)

... (truncated)

Commits

• 6e3c2b1 Release 2.1.12
• 8a63018 Update changelog
• 28c3412 Fix php proxies to resolve FILE and DIR using realpath on PHP <8, fix...
• 3bb78fd Make new phar filename random to avoid possible concurrency issues, refs #10252
• 6a7264f Trigger autoloading of a few classes before executing self-update command, fi...
• abf832a Update what GitHub token scope is needed and what it implies (#10257)
• 4c9e567 Provide different URL options to encourage users to create low-privilege GitH...
• 9f433ab Fix 9999999-dev showing on composer show when no branch alias is defined for ...
• 5b47fa1 Add back abandoned key in repository search results (#10259)
• d7154c2 Fix GithubActionError on php 8.1 (#10250)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #473.