Checking composer.json: OK
Checking composer.lock: OK
Checking platform settings: OK
Checking git settings: OK git version 2.40.0
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com rate limit: OK
Checking disk free space: OK
Checking pubkeys: 
Tags Public Key Fingerprint: 57815BA2 7E54DC31 7ECC7CC5 573090D0  87719BA6 8F3BB723 4E5D42D0 84A14642
Dev Public Key Fingerprint: 4AC45767 E5EC2265 2F0C1167 CBBB8A2B  0C708369 153E328C AD90147D AFE50952
OK
Checking Composer version: You are not running the latest stable version, run `composer self-update` to update (2.8.11 => 2.10.2)
Checking Composer and its dependencies for vulnerabilities: WARNING
Audit found some issues:
Found 8 security vulnerability advisories affecting 2 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | medium                                                                           |
| CVE               | CVE-2026-59946                                                                   |
| Title             | Composer: Path traversal in package bin field lets dependencies chmod arbitrary  |
|                   | host files                                                                       |
| URL               | https://github.com/advisories/GHSA-gjfg-22fp-rrxx                                |
| Affected versions | >=1.0.0,<2.2.29|>=2.3.0,<2.10.2                                                  |
| Reported at       | 2026-07-20T21:57:40+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | medium                                                                           |
| CVE               | CVE-2026-59947                                                                   |
| Title             | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT     |
|                   | exposure)                                                                        |
| URL               | https://github.com/advisories/GHSA-g6xq-892h-64w3                                |
| Affected versions | >=1.0.0,<2.2.29|>=2.3.0,<2.10.2                                                  |
| Reported at       | 2026-07-20T21:55:05+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | high                                                                             |
| CVE               | CVE-2026-59948                                                                   |
| Title             | Composer: Arbitrary file write outside vendor via malicious transitive package   |
|                   | name                                                                             |
| URL               | https://github.com/advisories/GHSA-499r-g7pc-vmp9                                |
| Affected versions | >=1.0.0,<2.2.29|>=2.3.0,<2.10.2                                                  |
| Reported at       | 2026-07-20T19:15:29+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | high                                                                             |
| CVE               | CVE-2026-45793                                                                   |
| Title             | Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs             |
| URL               | https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2     |
| Affected versions | >=2.3,<2.9.8|>=2.0.0,<2.2.28|>=1.0,<1.10.28                                      |
| Reported at       | 2026-05-13T07:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | high                                                                             |
| CVE               | CVE-2026-40261                                                                   |
| Title             | Command injection via malicious Perforce source reference/url                    |
| URL               | https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q     |
| Affected versions | >=2.3,<2.9.6|>=1.0,<2.2.27                                                       |
| Reported at       | 2026-04-14T09:42:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | high                                                                             |
| CVE               | CVE-2026-40176                                                                   |
| Title             | Command injection via malicious Perforce repository definition                   |
| URL               | https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p     |
| Affected versions | >=2.3,<2.9.6|>=1.0,<2.2.27                                                       |
| Reported at       | 2026-04-14T09:42:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | low                                                                              |
| CVE               | CVE-2025-67746                                                                   |
| Title             | Composer is vulnerable to ANSI sequence injection                                |
| URL               | https://github.com/advisories/GHSA-59pp-r3rg-353g                                |
| Affected versions | >=2.3.0,<2.9.3|>=2.0.0,<2.2.26                                                   |
| Reported at       | 2025-12-30T17:44:10+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/process                                                                  |
| Severity          | medium                                                                           |
| CVE               | CVE-2026-24739                                                                   |
| Title             | Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to           |
|                   | destructive file operations on Windows                                           |
| URL               | https://github.com/advisories/GHSA-r39x-jcww-82v6                                |
| Affected versions | >=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51                    |
| Reported at       | 2026-01-28T21:28:10+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Composer version: 2.8.11
PHP version: 8.2.0
PHP binary path: C:\xampp\php\php.exe
OpenSSL version: OpenSSL 3.0.7 1 Nov 2022
curl version: 7.85.0 libz 1.2.12 brotli missing zstd missing ssl OpenSSL/3.0.7
zip: extension present, unzip not available, 7-Zip not available