A security release. Upgrading is recommended.

Fixed registry mirrors allowing server-side requests to private or internal network addresses through mirror URLs, Composer metadata, distribution URLs, or redirects. Mirror requests are now validated and DNS-pinned before connecting, redirects are revalidated, and credentials are only sent to the configured mirror origin. Trusted internal mirrors can be explicitly enabled with MIRROR_ALLOWED_PRIVATE_HOSTS.