Post #2490243
2026-05-13 12:32 UTC
🚨 Critical Composer Update: 2.9.8 & 2.2.28 fix a GitHub Actions token disclosure!
⚠️ Update NOW or disable GitHub Actions immediately!
https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/
#PHP #Composer #ComposerPHP #OpenSource #WebDevelopment #GitHubActions #DevSecOps #CyberSecurity #SoftwareUpdate #PatchRelease #DependencyManagement #SecurityFix #Programming #Packagist #PHPDev #ComposerUpdate #OpenSourceSoftware #WebDevLife #InfoSec #SecurityPatch #CodeSmart #DependencyManagement #SoftwareSecurity #TechUpdate
Replies (1)
-
@ghostwriter@phpc.social 2026-05-13 20:21
GitHub Actions token format `ghs_APPID_JWT` (~520 chars, variable length). Regex NEW: `ghs_[0-9]+_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+` https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens/#how-to-prepare-for-this-change OLD: `ghs_[A-Za-z0-9]{36}` https://github.blog/changelog/2021-03-04-authentication-token-format-updates/ #GitHub #GitHubAction #GitHubServerToken #GitHubToken #Regex