PHP Composer 2.11 ships dependency cooldowns
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Composer 2.11.0 adds a cooldown dependency policy that withholds newly published package versions for a configurable period before Composer installs them, narrowing the window in which malicious releases can reach projects. Security fixes are also subject to the cooldown unless opted out with --no-cooldown.