Composer 2.11 can delay installing brand-new package versions
PHP's package manager adds an opt-in cooldown policy that withholds freshly published versions for a set period, giving malware scanners time to catch a compromised release before it reaches your lockfile.
Composer 2.11.0 shipped on 29 October, and its headline feature is a new cooldown dependency policy: it can hold back a newly published package version for a set period before composer update or composer require will install it. The policy is off by default. You turn it on under config.policy.cooldown in composer.json, and it relies on a new published-time field from Packagist rather than the time field most packages report, which an attacker could backdate.
"config": {
"policy": { "cooldown": { "period": "1 day" } }
}Packagist’s own announcement explains the motivation: most malicious releases it has seen came from attackers who briefly took over a legitimate package, often through a compromised GitHub account. A cooldown, even just an hour, gives automatic malware detection a window to flag the bad release before it reaches your lockfile. A new --no-cooldown flag lets you skip the wait for an urgent fix, and composer install from an existing lock file is unaffected either way.
Why it matters: PHP has had its own supply-chain scares this year, same as npm. A cooldown costs nothing if you are not chasing same-day releases, and it closes exactly the kind of window attackers have been exploiting across package registries lately.
The caveat: it is opt-in, and while it is set it will delay a genuine security fix by exactly as long as the period you chose, unless you remember to pass --no-cooldown yourself.