Composer can now refuse to install a package version because it's too new. 👀
Composer 2.11 added dependency cooldowns.
You can tell Composer to skip package versions released in the last 24 hours when running "composer update" or "require".
Gives malicious releases some time…
Commit
6904f23
I thought there was already something like that
Or it was only on npm?
commit 6904f23