End of life / Composer / 2.5
End of life
Composer 2.5 is past end of life.
Security fixes stopped on 1 Sep 2023, 1154 days ago. New vulnerabilities in 2.5 won’t be fixed.
- Released
- 20 Dec 2022
- Active support
- —
- Security fixes
- ended 1 Sep 2023
- Latest
- 2.5.8
Upgrade to Composer 2.10: no end date announced yet.
Release cycles
Every Composer cycle, at a glance.
Active support means bug fixes and security fixes; after it, security fixes only. Past the end of security support, nothing.
- Active support
- Security fixes only
- Supported
- Ends within 90 days
- Ended
Cycle
Status
Released
Active until
Security until
Latest
What to upgrade to
Go to 2.10.
2.10 is the newest supported Composer cycle.
Before you upgrade
composer self-update moves to the newest release. 2.2 is a long-term release for PHP older than 7.2; don’t pin it on a modern server. Read the Composer 2.10 upgrade guide
How to check your version
Which Composer is this site on?
On the server
Know before support ends.
Porro reads the PHP, framework and database version from every site and tells you 90 days before support runs out.
Dates from endoflife.date/composer, checked daily · data as of 29 Oct 2026.