2026-05-13 10:43 UTC
🚨 Security advisory: Composer 2.9.8 and 2.2.28 (LTS) fix a vulnerability that lead Composer to leak GitHub Actions GITHUB_TOKENs and GitHub App installation tokens into job logs.
GitHub's new ghs_<id>_<JWT> token format fails Composer's validation regex; the rejected token is printed into the error message and secret masking does not reliably catch it.
Update now or disable affected Actions workflows.
https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/
Replies (3)
-
@packagist@phpc.social 2026-05-13 14:48
UPDATE: GitHub has rolled back their change to GitHub Actions tokens. It is no longer necessary to immediately disable GitHub Actions. We now have a few days to get the entire PHP ecosystem updated to safe Composer versions, before a new rollout of the new token format is attempted. GitHub is also looking into improving their secrets masking. Ideally a new rollout will not lead to any leaked credentials, even if they are accidentally exposed in logs. #php #composerphp #phpc
-
@arichtman@eigenmagic.net 2026-05-13 10:50
@packagist@phpc.social :swedishchefkiss:
-
@ghostwriter@phpc.social 2026-05-13 17:25
@packagist@phpc.social, when you get a chance, could you please tag a 2.10.0-RC2 release to fix the vulnerability in 2.10.0-RC1. Thank you.