Composer 2.11 Adds Opt-In Dependency Cooldowns to Reduce PHP Supply Chain Risk

Composer 2.11 introduces opt-in dependency cooldowns that keep newly published PHP package versions ineligible for installation until a configured waiting period has elapsed. The safeguard applies during dependency resolution, not installations from existing lockfiles. It uses Packagist’s registry-recorded publication timestamps to prevent attackers from bypassing the delay by backdating releases. Security fixes receive no automatic exemption, although developers can explicitly bypass the cooldown for urgent updates or configure permanent package exemptions.

The release follows PHP ecosystem compromises involving taken-over GitHub accounts and stolen access tokens, including incidents affecting laravel-lang and intercom/intercom-php. It extends Composer and Packagist’s broader security work, including malware detection, public transparency logs, stable-version immutability, and Composer 2.10’s unified policy framework for malware-flagged versions, vulnerability advisories, and abandoned packages. Organizations adopting cooldowns should define a waiting period and an urgent-patch exception process: the feature reduces immediate exposure to malicious releases but can also delay legitimate security updates.