Bump composer/composer from 2.10.2 to 2.10.3

[dependabot]

Bumps composer/composer from 2.10.2 to 2.10.3.

Release notes

Sourced from composer/composer's releases.

2.10.3

• Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
• Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3, CVE-2026-84361)
• Security: Sanitize URL-embedded usernames/token in a few more places (#13044)
• Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
• Fixed PHP 8.6 deprecation warnings (#12967, #13028)
• Fixed error output when a policy blocks a package version to be clearer (#12993)
• Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
• Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)
• Fixed forgejo support to handle empty repositories better (#12968)
• Fixed FilterListApiClient not forwarding transport options (#13040)

Full Changelog: composer/composer@2.10.2...2.10.3

Changelog

Sourced from composer/composer's changelog.

[2.10.3] 2026-08-27

• Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
• Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
• Security: Sanitize URL-embedded usernames/token in a few more places (#13044)
• Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
• Fixed PHP 8.6 deprecation warnings (#12967, #13028)
• Fixed error output when a policy blocks a package version to be clearer (#12993)
• Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
• Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)
• Fixed forgejo support to handle empty repositories better (#12968)
• Fixed FilterListApiClient not forwarding transport options (#13040)

Commits

• f0de0bf Release 2.10.3
• f247758 Update changelog
• 0aac505 Merge commit from fork
• 53b8bb4 Merge commit from fork
• 24e396b Make it possible to pass transport options to FilterListApiClient (#13040)
• f383d23 Do not use a conflicted content-hash as the autoloader suffix (#13048)
• ada0055 Mask URL credentials anywhere in a string, not just at its start (#13044)
• cd19785 Prevent curl SSL version parsing across lines (#13046)
• eba7baa Fix Url::getOrigin prefix-matching a host against gitlab-domains (#12988)
• 5e9f655 Include the failed URL in max-file-size and content-length errors (#13041)
• Additional commits viewable in compare view

[veewee]

@dependabot rebase