The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Composer 2.11 Adds Dependency Cooldowns
- Published
- Record updated
Summary
Composer 2.11 adds dependency cooldowns, letting PHP developers delay newly published package versions through the config.policy.cooldown setting, which takes waiting periods in hours, days or weeks. The feature is disabled by default, and Composer 2.11 uses Packagist's new published-time field rather than publisher-supplied dates to prevent backdating bypasses.
Mitigation
Enable the feature with the config.policy.cooldown setting (disabled by default); organizations can enforce cooldowns through Private Packagist. Developers can use --no-cooldown to install an urgent fix immediately.