馃摝 Composer 2.10 is out today.
Native malware filtering, powered by an Aikido feed and enabled by default for everyone installing from Packagist. The new unified config.policy framework consolidates handling of malware, security advisories, and abandoned packages, and also lets organizations plug in their own custom policies.
Source fallback is now deprecated, and there's wildcard support in composer update --with.
