>>> composer: Building community/composer 2.10.2-r0 (using abuild 3.18.0_rc7-r1) started Fri, 16 Oct 2026 21:13:21 +0000 >>> composer: Validating /home/buildozer/aports/community/composer/APKBUILD... >>> composer: Analyzing dependencies... >>> composer: Installing for build: build-base php85 php85-phar php85-curl php85-iconv php85-mbstring php85-openssl php85-zip p7zip git ( 1/16) Installing php85-common (8.5.11-r0) ( 2/16) Installing argon2-libs (20190702-r5) ( 3/16) Installing xz-libs (5.8.4-r0) ( 4/16) Installing libxml2 (2.13.9-r2) ( 5/16) Installing php85 (8.5.11-r0) ( 6/16) Installing php85-phar (8.5.11-r0) ( 7/16) Installing php85-curl (8.5.11-r0) ( 8/16) Installing php85-iconv (8.5.11-r0) ( 9/16) Installing oniguruma (6.9.10-r0) (10/16) Installing php85-mbstring (8.5.11-r0) (11/16) Installing php85-openssl (8.5.11-r0) (12/16) Installing libbz2 (1.0.8-r6) (13/16) Installing libzip (1.12.1-r0) (14/16) Installing php85-zip (8.5.11-r0) (15/16) Installing 7zip (26.02-r0) (16/16) Installing .makedepends-composer (20261016.211325) Executing busybox-1.38.0-r7.trigger OK: 315.0 MiB in 118 packages >>> composer: Cleaning up srcdir >>> composer: Cleaning up pkgdir >>> composer: Cleaning up tmpdir >>> composer: Fetching https://distfiles.alpinelinux.org/distfiles/v3.25/composer-2.10.2.phar Connecting to distfiles.alpinelinux.org (172.105.82.32:443) wget: server returned error: HTTP/1.1 404 Not Found >>> composer: Fetching composer-2.10.2.phar::https://getcomposer.org/download/2.10.2/composer.phar Connecting to getcomposer.org (57.128.19.244:443) saving to '/var/cache/distfiles/v3.25/composer-2.10.2.phar.part' composer-2.10.2.phar 100% |********************************| 3553k 0:00:00 ETA '/var/cache/distfiles/v3.25/composer-2.10.2.phar.part' saved /var/cache/distfiles/v3.25/composer-2.10.2.phar: OK >>> composer: Fetching https://distfiles.alpinelinux.org/distfiles/v3.25/composer-2.10.2.phar /var/cache/distfiles/v3.25/composer-2.10.2.phar: OK Composer version 2.10.2 2026-07-01 11:24:45 PHP version 8.5.11 (/usr/bin/php85) Run the "diagnose" command to get more detailed diagnostics output. Checking pubkeys: FAIL Missing pubkey for tags verification Missing pubkey for dev verification Run composer self-update --update-keys to set them up Checking Composer version: You are not running the latest stable version, run `composer self-update` to update (2.10.2 => 2.10.3) Composer version: 2.10.2 Checking Composer and its dependencies for vulnerabilities: WARNING Audit found some issues: Found 2 security vulnerability advisories affecting 1 package: +-------------------+----------------------------------------------------------------------------------+ | Package | composer/composer | | Severity | medium | | Advisory ID | PKSA-ddsx-fjz2-sbs3 | | CVE | CVE-2026-59944 | | Title | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | | URL | https://github.com/advisories/GHSA-96h3-5x6v-m776 | | Affected versions | >=1.0,<2.2.30|>=2.3.0,<2.10.3 | | Reported at | 2026-10-02T19:14:34+00:00 | +-------------------+----------------------------------------------------------------------------------+ +-------------------+----------------------------------------------------------------------------------+ | Package | composer/composer | | Severity | high | | Advisory ID | PKSA-ym19-cy3j-z6df | | CVE | CVE-2026-84361 | | Title | Composer arbitrary command execution via a malicious package's Perforce source | | | URL | | URL | https://github.com/advisories/GHSA-rvx4-ffvw-m9q3 | | Affected versions | >=1.0,<2.2.30|>=2.3.0,<2.10.3 | | Reported at | 2026-09-08T21:25:41+00:00 | +-------------------+----------------------------------------------------------------------------------+ PHP version: 8.5.11 PHP binary path: /usr/bin/php85 OpenSSL version: OpenSSL 3.5.9 29 Sep 2026 curl version: 8.22.0 libz 1.3.2 brotli brotli/1.2.0 zstd supported ssl OpenSSL/3.5.9 HTTP 1.0, 1.1, 2 zip: extension present, unzip present, 7-Zip present (7z) Checking platform settings: OK Checking git settings: OK git version 2.56.0 Checking http connectivity to packagist: OK Checking https connectivity to packagist: OK Checking github.com rate limit: OK Checking disk free space: OK >>> composer: Entering fakeroot... >>> composer-bash-completion*: Running split function bashcomp... 'usr/share/bash-completion/completions' -> '/home/buildozer/aports/community/composer/pkg/composer-bash-completion/usr/share/bash-completion/completions' >>> composer-bash-completion*: Preparing subpackage composer-bash-completion... >>> composer-bash-completion*: Running postcheck for composer-bash-completion >>> composer*: Running postcheck for composer >>> composer*: Preparing package composer... >>> composer*: Tracing dependencies... php85 php85-phar php85-curl php85-iconv php85-mbstring php85-openssl php85-zip p7zip >>> composer*: Package size: 3.5 MB >>> composer*: Compressing data... >>> composer*: Create checksum... >>> composer*: Create composer-2.10.2-r0.apk >>> composer-bash-completion*: Tracing dependencies... >>> composer-bash-completion*: Package size: 2.7 KB >>> composer-bash-completion*: Compressing data... >>> composer-bash-completion*: Create checksum... >>> composer-bash-completion*: Create composer-bash-completion-2.10.2-r0.apk >>> composer: Build complete at Fri, 16 Oct 2026 21:13:28 +0000 elapsed time 0h 0m 7s >>> composer: Cleaning up srcdir >>> composer: Cleaning up pkgdir >>> composer: Cleaning up tmpdir >>> composer: Uninstalling dependencies... ( 1/16) Purging .makedepends-composer (20261016.211325) ( 2/16) Purging php85-phar (8.5.11-r0) ( 3/16) Purging php85 (8.5.11-r0) ( 4/16) Purging php85-curl (8.5.11-r0) ( 5/16) Purging php85-iconv (8.5.11-r0) ( 6/16) Purging php85-mbstring (8.5.11-r0) ( 7/16) Purging php85-openssl (8.5.11-r0) ( 8/16) Purging php85-zip (8.5.11-r0) ( 9/16) Purging php85-common (8.5.11-r0) (10/16) Purging 7zip (26.02-r0) (11/16) Purging argon2-libs (20190702-r5) (12/16) Purging libxml2 (2.13.9-r2) (13/16) Purging libzip (1.12.1-r0) (14/16) Purging oniguruma (6.9.10-r0) (15/16) Purging xz-libs (5.8.4-r0) (16/16) Purging libbz2 (1.0.8-r6) Executing busybox-1.38.0-r7.trigger OK: 294.3 MiB in 102 packages >>> composer: Updating the community/x86 repository index... >>> composer: Signing the index...