Composer 2.5 End of Life
Support dates and upgrade guidance — rebuilt from live data.
End of Life
Composer 2.5 reached end of life on 1 Sept 2023. It no longer receives security fixes.
1,073 days without security patches
Recommended action: upgrade to Composer 2.10. Check your versioncomposer --version
Support timeline
Official dates from the Composer release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 20 Dec 2022 | — |
| End of life | 1 Sept 2023 | 2.9 years ago |
| Latest release | 2.5.8 · 9 Jun 2023 | final |
Where to go from 2.5
Recommended target: Composer 2.10.
The newest actively supported branch is Composer 2.10 (latest release 2.10.2).
Frequently asked questions
Is Composer 2.5 still safe to use?
Composer 2.5 reached end of life on 1 Sept 2023, 1,073 days ago, and is no longer covered by standard support. Running it means no guaranteed security fixes.
Can I still download Composer 2.5?
Yes — the final release (2.5.8) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Composer 2.5 to?
Upgrade to Composer 2.10, the newest actively supported branch.