Project
Composer is the standard dependency manager for PHP, resolving package versions via Packagist and locking them in composer.lock for reproducible installs.
Laravel calls the breaking changes in 13 minimal, and the upgrade guide still flags about nineteen of them. Two land in defaults that every application touches: the request forgery middleware and the cache config.
Reality
The rewritten PHP copy/paste detector reached Packagist on September 13, and the script in its release gate reads the header of every file in src/ and exits non-zero while one copyright holder is still inherited.
Reality
Attestation proves a package came out of the pipeline it names. When the pipeline is the thing that was owned, the seal still verifies, and a gate that only checks origin passes all 84 versions pushed on May 11.
Reality
The IDE stays a Windows process while a small Linux-side agent does the file and process work. That is the fourth architecture JetBrains has tried for WSL, and the first one it names as the recommended entry point.
Reality
Socket says trojanized OphimCMS and KKPhim themes chain two WebKit bugs to an IOKit kernel escape on visitors' iPhones, turning a Composer dependency problem into wallet seed theft from people who only loaded a page.
Reality
Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.
Reality
Larameter derives the plan and rolls windows on their own grid, so the renewal webhook and the reset cron go away. The arithmetic it ships with is worth checking before you inherit it.
Reality
StepSecurity's first annual report logs 56 confirmed supply chain compromises and says plainly that these are its own alerts. The February change is the finding; explaining it is the hard part.
Reality
A dev.to walkthrough puts the laravel-lang tag rewrite at 90 minutes and 5,561 poisoned repositories in six hours. The caret range in your composer.json never got a vote.
Reality