PHP Composer

• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13254)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13209)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13185)

Full Changelog: https://github.com/composer/composer/compare/2.2.31...2.2.32