Versions 2.10.2 (July 1) and 2.10.3 (August 27) fixed a run of CVEs: path traversal through package bin paths (including via symlinks), file writes outside vendor/, tokens leaking into verbose logs, and command injection through malicious Perforce URLs.
