--- title: "Packagist Urges Immediate Composer Update After GitHub Actio..." url: https://daily.dev/posts/packagist-urges-immediate-composer-update-after-github-actio--rnc1xnnjj source_url: https://socket.dev/blog/packagist-urges-immediate-composer-update type: article source: "Socket" published: 2026-05-13T16:07:54.128Z updated: 2026-05-13T16:08:15.128Z tags: ["security", "php", "github-actions"] reading_time: 3 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Packagist Urges Immediate Composer Update After GitHub Actio... **[Socket](https://daily.dev/sources/socketdev)** · 3 min read · 1 upvotes · 0 comments ## Summary Packagist is urging PHP projects to immediately update Composer after a GitHub token format change caused GitHub Actions tokens to be exposed in CI logs. Composer versions 2.9.8, 2.2.28 LTS, and 1.10.28 fix a vulnerability where Composer printed full GITHUB_TOKEN values to stderr when token validation failed. The issue was triggered by GitHub's rollout of a new token format using hyphens, which Composer's regex rejected. GitHub has since rolled back the format change, reducing immediate risk, but updating Composer remains urgent. Teams should update immediately, review recent Actions logs for failed Composer runs, delete affected log contents, and check for unexpected activity tied to any exposed credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/packagist-urges-immediate-composer-update-after-github-actio--rnc1xnnjj)