Commit

Composer can now refuse to install a package version because it's too new. 👀 Composer 2.11 added dependency cooldowns. You can tell Composer to skip package versions released in the last 24 hours when running "composer update" or "require". Gives malicious releases some time to get caught before they land in your project. It's opt-in, and "composer install" isn't affected. Pretty useful addition!