#13078·composer

ssh/git user stripped from repo address on private satis+forge deps

Author: pips-Created Sep 18, 2026Updated Sep 18, 2026

Hello,

I opened a discussion and it seems this behavior may not be intended.

we have a forge for some of our internal packages, and we use a private satis instance to distribute/reference theses packages

in some of our project we configured theses packages using "dev-" or "-dev" version to get a git-branch we can work on from the main project, with a composer.json like:

    "require": {
        "internal/package-A": "dev-feature/branch",

but, then when we composer install the git repository address get stripped from the forge user:

❯ git remote show -n origin
* remote origin
  Fetch URL: ssh://git.int....
  Push  URL: ssh://git.int....

same thing happen with the "composer" git-remote

before version 2.10.3 the result included our forge ssh-user like this (the "gogs@"):

❯ git remote show -n origin
* remote origin
  Fetch URL: ssh://[email protected]....
  Push  URL: ssh://[email protected]....

Trying to do a git-bisect point me to this commit and so this related PR

In the discussion @Yuno15-bb did some testing with the stripCredentials method and found out the behavior change from the code.

let me know if you need more information about this issue :)

thanks a lot for the great work on composer! ;)