[MEDIUM] Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

PKSA-4pm6-g63v-5rkr CVE-2026-59947 GHSA-g6xq-892h-64w3

Affected package: composer/composer

Affected version: >=1.0.0,<2.2.29|>=2.3.0,<2.10.2

Reported by:
GitHub