json
"config": { "policy": { "cooldown": { "period": "1 day" } } }
@composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update.
Composer 2.11 includes several security fixes, block-scope support for custom…
Private PackagistComposer 2.11We are pleased to announce the release of Composer 2.11.0. The highlight of this release is the new cooldown dependency policy, which withholds newly published package versions for a configurable period of time before Composer will install them. Composer 2.11 also ships several security fixes, removes the
commit 3008516