Version 1.0.3 - 2016-04-29

• Security: Fixed possible command injection from the env vars into our sudo detection
• Fixed interactive authentication with gitlab
• Fixed class name replacement in plugins
• Fixed classmap generation mistakenly detecting anonymous classes
• Fixed auto-detection of stability flags in complex constraints like 2.0-dev || ^1.5
• Fixed content-length handling when redirecting to very small responses

Version 1.0.2

• Fixed regression in 1.0.1 on systems with mbstring.func_overload enabled
• Fixed regression in 1.0.1 that made dev packages update to the latest reference even if not whitelisted in a partial update
• Fixed init command ignoring the COMPOSER env var for choosing the json file name
• Fixed error reporting bug when the dependency resolution fails
• Fixed handling of $ sign in composer config command in some cases it could corrupt the json file

Version 1.0.1

• Fixed URL updating when a package's URL changes, composer.lock now contains the right URL including correct reference
• Fixed URL updating of the origin git remote as well for packages installed as git clone
• Fixed binary .bat files generated from linux being incompatible with windows cmd
• Fixed handling of paths with trailing slashes in path repository
• Fixed create-project not using platform config when selecting a package
• Fixed self-update not showing the channel it uses to perform the update
• Fixed file downloads not failing loudly when the content does not match the Content-Length header
• Fixed secure-http detecting some malformed URLs as insecure
• Updated CA bundle

Notice system CA is always preferred, bundled copy is only used as a last chance fallback.