November 2026 Summaries

Composer 2.11 introduces an optional dependency cooldown policy that lets PHP developers delay installation of newly published package versions by configurable hours, days, or weeks, reducing exposure to supply chain compromises while leaving existing lockfile installs unchanged. The feature uses Packagist’s registry-controlled published-time metadata rather than publisher-supplied timestamps, preventing attackers from backdating malicious releases to bypass waiting periods, and repositories lacking this metadata will fail resolution unless a fallback is configured. Private Packagist can enforce cooldowns organization-wide, while developers can bypass them for urgent updates with a command-line option or permanently exempt selected packages. The release follows recent attacks affecting PHP packages and aligns Composer with a wider industry trend, as package tools including pnpm, Yarn, npm, Bun, Bundler, Cargo, and GitHub Dependabot adopt release-age delays; unlike some peers, however, Composer leaves cooldowns disabled by default and does not automatically exempt security fixes because such exemptions could be abused.