As cited
Copy frozen at (site build).
vulnerabilities
Composer 2.11 Adds Dependency Cooldowns
Composer 2.11 introduces dependency cooldowns, allowing PHP developers to specify a waiting period before newly published packages become eligible for installation. The feature uses a trustworthy published-time timestamp from Packagist rather than dates supplied by package publishers, preventing attackers from backdating malicious releases. Composer joins other major package managers including pnpm, Yarn, Ruby's Bundler, and Rust's Cargo in adopting cooldowns as a supply chain security practice.
Why it matters: PHP developers and organizations managing dependencies should evaluate cooldown policies to reduce exposure to compromised packages; teams can configure organization-wide settings through Private Packagist or set cooldowns individually via config.policy.cooldown.
- Source published
- First seen by Cybersecurity Tracker