@composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update.
Composer 2.11 includes several security fixes, block-scope support for custom dependency policies, OSC 7501 terminal progress reporting and faster and more memory efficient dependency resolution.
Full blog post: https://blog.packagist.com/composer-2-11-release/
Private PackagistComposer 2.11We are pleased to announce the release of Composer 2.11.0. The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions for a configurable period of time before Composer will install them. Composer 2.11 also ships several security fixes, removes the
commit 8075cd8
json
"config": { "policy": { "cooldown": { "period": "1 day" } } }