PHP Composer 2.11 ships dependency cooldowns
Comments on “PHP Composer 2.11 ships dependency cooldowns”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Composer 2.11.0 adds a cooldown dependency policy that withholds newly published package versions for a configurable period before Composer installs them, narrowing the window in which malicious releases can reach projects. Security fixes are also subject to the cooldown unless opted out with --no-cooldown.
Why it ranked
No. 78 of 111 with a score of 0.58. The panel rated it highest on new information (0.91) and substantiated (0.88), lowest on audience breadth (0.57). The claim check took 0.100 off. Placed No. 78, No. 71 by score alone: the tenth Programming & dev tools story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- A concrete release of a widely used package manager with a new supply-chain cooldown policy, security fixes and detailed config. Substantial practical value, though partly a vendor-flavored changelog post.
- AI judgeJudge 3gpt-5.6-luna
- A well-supported Composer release introduces configurable dependency cooldowns, security fixes, and operational changes directly relevant to software supply-chain security and PHP developers. It is practical and technically detailed, with limited promotional content and little unsupported extrapolation.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.58total under rubric v2.3
- Significance0.65
- Reader interest0.73
- Audience breadth0.57
- Practical relevance0.84
- Substantiated0.88
- Technical depth0.81
- New information0.91
- Counts against: Promotional0.18
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.68 | 0.55 | 0.72 | 0.65 | 0.17 | +0.24 | +0.156 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.75 | 0.62 | 0.82 | 0.73 | 0.20 | +0.26 | +0.190 |
| Audience breadthHow many people who build technology does it concern? | 0.53 | 0.67 | 0.50 | 0.57 | 0.17 | +0.13 | +0.074 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.94 | 0.80 | 0.78 | 0.84 | 0.17 | +0.22 | +0.185 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.90 | 0.80 | 0.93 | 0.88 | 0.13 | +0.05 | +0.044 |
| Technical depthHow technically substantive is it? | 0.89 | 0.72 | 0.82 | 0.81 | 0.17 | +0.05 | +0.041 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.88 | 0.90 | 0.95 | 0.91 | 0.07 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.08 | 0.35 | 0.12 | 0.18 | 0.27 | −0.19 | −0.035 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.14 | 0.20 | 0.08 | 0.14 | 0.12 | −0.11 | −0.015 |
| Sum of contributions | +0.684 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.584 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/78/"><img src="https://rubric.hrih.si/badge/2026-10-31/78.svg" alt="Ranked #78 on Rubric, 31 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 4 matches source · 1 not in source · 1 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceVersion
Composer 2.11.0 introduces a cooldown dependency policy that withholds newly published package versions for a configurable period before Composer will install them.
The cited source says the same thing.
The article says “The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions for a configurable period of time before Composer will install them”
The source says “Added a `cooldown` policy to withhold newly released package versions for a configurable period, reducing exposure to compromised releases”
Source cited by the article: github.com/composer/composer/releases/tag/2.11.0
Not in sourceGeneralization
Most malicious releases seen on Packagist.org in recent months were published by attackers who briefly gained control of a legitimate package, for example through a compromised GitHub account.
The cited source does not contain it.
The article says “Most malicious releases we have seen on Packagist.org in the past months were published by attackers who briefly gained control of a legitimate package, for example through a compromised GitHub…”
The source says “We are pleased to announce the release of Composer 2.11.0. The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions”
Source cited by the article: packagist.org
No source givenNumber
Automated malware scanners can flag the first problems within minutes of a release.
The article gives no link or citation for it.
The article says “Automated malware scanners can flag the first problems within minutes of a release”
The source says No source to compare with.
Couldn’t checkVersion
Packagist.org now includes a published-time for every version, based on when Packagist.org itself first made the version available.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Packagist.org now includes a published-time for every version, based on when Packagist.org itself first made the version available”
The source says No passage could be compared.
Source cited by the article: github.com/composer/packagist/pull/1765
Matches sourceVersion
Composer 2.11 removes the source-fallback option deprecated in 2.10, so dist installs no longer fall back to source.
The cited source says the same thing.
The article says “Composer 2.11 removes this option, and dist installs no longer fall back to source”
The source says “Remove source-fallback option that was added in 2.10 as a stop-gap measure”
Source cited by the article: github.com/composer/composer/pull/13050
Matches sourceVersion
Private Packagist already supports cooldown policies, and organization admins can enforce them for all projects regardless of the Composer version used.
The cited source says the same thing.
The article says “Private Packagist then holds back recently published versions for every project using the organization's Composer repository, regardless of the project's composer.json and of the Composer version in use”
The source says “To hold back new versions for all projects that use your organization's Composer repository, independent of their composer.json and Composer version, configure a cooldown dependency policy under Settings > Security”
Source cited by the article: packagist.com/docs/cooldown-dependency-policy
Couldn’t checkBenchmark result
Composer 2.11 makes dependency resolution faster and lower in memory use.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Dependency resolution is faster and uses less memory”
The source says No passage could be compared.
Source cited by the article: github.com/composer/composer/pull/13071
Matches sourceCausal conclusion
Composer 2.11 no longer requests HTTP/3, which added a delay to every new connection with recent curl versions.
The cited source says the same thing.
The article says “Composer no longer requests HTTP/3, which added a delay to every new connection with recent curl versions”
The source says “Forcing `CURL_HTTP_VERSION_3` makes curl start a QUIC handshake first and only fall back to TCP after a delay derived from the happy-eyeballs timeout, on every new connection”
Source cited by the article: github.com/composer/composer/pull/13096
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.