Composer 2.11 Adds Dependency Cooldowns

Composer 2.11 Adds Dependency Cooldowns Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates. - Sarah Gooding Composer 2.11 has introduced dependency cooldowns, giving PHP developers a native way to delay newly published package versions before they become eligible for installation. The release arrives nearly a year after developers first requested the feature, bringing Composer into line with package managers that have already adopted minimum release age policies to reduce exposure to supply chain attacks. The new config.policy.cooldown setting allows developers to specify a waiting period in hours, days, or weeks. It is disabled by default and applies during dependency resolution, including composer update and composer require . Existing lockfile installations remain unaffected. The feature also supports organization-wide configuration through Private Packagist, which can enforce cooldowns regardless of the Composer version developers and CI systems are running. Preventing Cooldown Bypasses #The original GitHub issue opened in November 2025 and gained urgency following a series of high-profile supply chain compromises. An initial implementation was submitted in December, but the feature missed Composer 2.10 as the maintainers worked through how to enforce cooldowns reliably. In May, after additional attacks affected Packagist, developers pressed the maintainers for an update. Composer co-founder Nils Adermann explained that the feature was being held up by changes needed to make release metadata trustworthy. The existing time field in Composer package metadata could be derived from a Git commit date or supplied through composer.json . Both are under the publisher's control, allowing an attacker to backdate a malicious release and bypass a cooldown. Packagist introduced a new published-time field in June, recording when a version first became available through the registry. Composer 2.11 now uses that timestamp rather than trusting dates supplied by package publishers. Repositories without the required metadata cause dependency resolution to fail unless an explicit fallback is configured. The cooldown feature is part of a broader security effort by Composer and Packagist. In a May security update, maintainers specifically cited the April compromise of intercom/intercom-php , and the May attack on Laravel Lang among recent incidents affecting the PHP ecosystem. The update outlined several security initiatives, including malware detection, version immutability, and the planned cooldown policy. Cooldowns Are Now Standard Across Package Ecosystems #For years, dependency management favored staying on the latest compatible releases. That assumption is changing. With compromised packages appearing on a regular basis, living on the bleeding edge has become considerably less appealing. Cooldowns are increasingly treated as standard supply chain security practice, and some package managers have already made them the default. Composer is joining a movement already well underway across JavaScript, Ruby, Python, and Rust tooling. pnpm introduced minimum release ages in September 2025 and made a 24-hour delay the default in version 11. Yarn has also enabled a release-age gate by default, while npm and Bun offer configurable delays. GitHub introduced a three-day default cooldown for Dependabot version updates in July. In Ruby, Bundler added cooldown support in June, and gem.coop began testing registry-level delays earlier this year. Cargo is next, with minimum publish age support scheduled to become stable in Rust 1.100 on November 12. Unlike pnpm and Yarn, Composer is leaving the feature opt-in, a decision its maintainers debated during development over concerns about disrupting existing workflows. Composer also deliberately avoids automatically exempting security fixes. The maintainers rejected that approach because an attacker with publishing access could potentially create an advisory or exploit an existing one to get a malicious release through the cooldown. Developers can use --no-cooldown to install an urgent fix immediately without disabling other security policies. Composer also supports permanent exemptions for specific packages through the cooldown policy's ignore setting. Security fixes still demand quick updates, especially as AI-assisted vulnerability disclosures accelerate, but for routine dependency updates, cooldowns are becoming best practice. Composer's implementation arrives later than many of its peers, but its adoption adds another major ecosystem to the shift toward giving new dependencies time to be examined before installation.