GitHub Actions Token Leak Prompts Urgent Composer Update Warning

A recent GitHub change to GitHub App installation token formatting caused Composer to reject the new token format and print full tokens to stderr, potentially exposing access tokens in CI logs for thousands of PHP projects using Composer in GitHub Actions. Packagist and Composer released fixes (Composer 2.9.8 / 2.2.28 LTS and Composer 1.10.28 for legacy), GitHub temporarily rolled back the change, and developers are urged to update Composer, audit logs, and rotate deleted/affected tokens; tokens on GitHub-hosted runners generally expire within 6 hours while self-hosted runners may retain validity up to 24 hours.