Composer · Lifecycle Status

Composer End of Life (EOL) Dates & Support Timeline

Complete end-of-life dates, support windows, and security status for all Composer versions. Data sourced from endoflife.date and official vendor documentation. Updated at every deploy.

✓ Composer 2.2.27 is actively supported. No versions approaching EOL in the next 6 months.
Latest Active
2.2.27
2.2 series
Next EOL
—
None upcoming
Active Versions
2
of 11 total
EOL Versions
9
no longer patched
Release Cycle Timeline
■ EOL   ■ Warning   ■ Active   ┊ Today
Release cycle timeline 201720182019202020212022202320242025202612.02.12.22.32.42.52.62.72.82.9TODAY
All Versions
VersionLatest ReleaseRelease DateEOL DateDaysStatus
1 1.10.27 Apr 5, 2016 Oct 24, 2020 2023 days past EOL EOL
2.0 2.0.14 Oct 24, 2020 Jun 3, 2021 1801 days past EOL EOL
2.1 2.1.14 Jun 3, 2021 Dec 22, 2021 1599 days past EOL EOL
2.2 LTS 2.2.27 Dec 22, 2021 Already EOL Supported Active
2.3 2.3.10 Mar 30, 2022 Aug 16, 2022 1362 days past EOL EOL
2.4 2.4.4 Aug 16, 2022 Dec 20, 2022 1236 days past EOL EOL
2.5 2.5.8 Dec 20, 2022 Sep 1, 2023 981 days past EOL EOL
2.6 2.6.6 Sep 1, 2023 Feb 8, 2024 821 days past EOL EOL
2.7 2.7.9 Feb 8, 2024 Oct 2, 2024 584 days past EOL EOL
2.8 2.8.12 Oct 2, 2024 Nov 13, 2025 177 days past EOL EOL
2.9 2.9.7 Nov 13, 2025 Already EOL Supported Active

What does Composer end of life mean for your organization?

When a Composer version reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.

The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.

Organizations running EOL Composer should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.

Check your full stack for EOL risk

Upload requirements.txt, package.json, or Gemfile — full EOL report instantly.

Open Stack Scanner →
Frequently Asked Questions
What is the end-of-life date for Composer?
See the full table above for all Composer version EOL dates.
What is the latest supported version of Composer?
The latest active version of Composer is 2.2.27. Always verify against the table above as support windows can change.
What happens when Composer reaches end of life?
When Composer reaches end of life, the vendor stops issuing security patches. Any CVEs disclosed after the EOL date accumulate indefinitely with no patch path — creating an ever-growing attack surface that most vulnerability scanners do not flag.
How do I check if I'm running an EOL version of Composer?
Check your current version against the table above. If your version's EOL date has passed, you are running unsupported software. You can also use the endoflife.ai Stack Scanner to check your entire dependency file at once.
Is there extended support available for EOL Composer versions?
Some vendors offer extended support for EOL software. Contact the original vendor or check with enterprise support providers for options.

Related Products

Python
View EOL timeline →
Node.js
View EOL timeline →
Ubuntu
View EOL timeline →
Data from endoflife.date API · endoflife.date · Generated at build time · How we source data →