Package: composer Version: 2.0.9-2 On March 4, 2021, GitHub announced a change to the format of their tokens: https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
A few days later, Composer updated their token validation regex to account for the new token format: https://github.com/composer/composer/commit/dc83ba93f3d8a35629f9a387632e8cd373a144d0#diff-0ad46c42da3ec5293b4b4df61bb6c837304d5e72f1a434ba3cff31c0f3e44934 It looks like Debian is still on 2.0.9 for the Bullseye freeze, implying that Bullseye will release with 2.0.9. You may want to backport the above fix so that people can use new format GitHub tokens with composer.