End of life / Composer / 1
End of life
Composer 1 is past end of life.
Security fixes stopped on 30 May 2026, 152 days ago. New vulnerabilities in 1 won’t be fixed.
- Released
- 5 Apr 2016
- Active support
- —
- Security fixes
- ended 30 May 2026
- Latest
- 1.10.28
Upgrade to Composer 2.10: no end date announced yet.
Release cycles
Every Composer cycle, at a glance.
Active support means bug fixes and security fixes; after it, security fixes only. Past the end of security support, nothing.
- Active support
- Security fixes only
- Supported
- Ends within 90 days
- Ended
Cycle
Status
Released
Active until
Security until
Latest
What to upgrade to
Go to 2.10, not 2.2.
2.2 runs out in 63 days. 2.10 is the newest supported Composer cycle.
Before you upgrade
composer self-update moves to the newest release. 2.2 is a long-term release for PHP older than 7.2; don’t pin it on a modern server. Read the Composer 2.10 upgrade guide
How to check your version
Which Composer is this site on?
On the server
Know before support ends.
Porro reads the PHP, framework and database version from every site and tells you 90 days before support runs out.
Dates from endoflife.date/composer, checked daily · data as of 29 Oct 2026.