The feature enables teams to designate a waiting period during commands like require and update, leaving existing lock file installations untouched. To enforce this, the system reads an authoritative published-time field provided directly by Packagist.org instead of author-defined timestamps. Developers can fine-tune exemptions using wildcards, version constraints, command-line flags, or environment variables. Furthermore, the 2.11.0 update resolves dependency trees faster while patching six separate security vulnerabilities.
Key points
Setting a cooldown period helps prevent development teams from immediately pulling malici…: Setting a cooldown period helps prevent development teams from immediately pulling malicious updates into their software projects.
Administrators can bypass the waiting period entirely or exempt particular packages using…: Administrators can bypass the waiting period entirely or exempt particular packages using granular ignore rules with wildcard patterns.
Teams relying on the automated fallback to source-based installations must adjust their c…: Teams relying on the automated fallback to source-based installations must adjust their configurations because the behavior has been discontinued.
Sources checked by our analysis pipeline: 1
Composer 2.11.0 has a new cooldown dependency policy. You set a waiting time, such as one day, and Composer skips any package version published more recently than that. Composer 2.10 added the first dependency policies, which block versions with security advisories or known malware.
This release also includes six security fixes and faster dependency resolution. If you still depend on Composer falling back to source installs, check the upgrade notes first, since that behavior is gone.
What's New
Cooldown Dependency Policy
Say you set a one-day cooldown, and someone publishes a malicious version of a package you depend on. Composer won't install that version for a day after it was published. If the version is reported and removed in that time, your project never installs it. The policy is off until you set a period
Singapore authorities are alerting the public to deceptive text messages originating from overseas numbers and random email accounts that mimic legitimate delivery firms. The campaign exploits urgent delivery warnings to deceive recipients into visiting fraudulent websites that siphon banking credentials. The advisory comes as financial fraud continues to dominate crime figures, resulting in hundreds of millions in financial losses nationwide.
The policy shift targets products like digital chatbot services that appeal heavily to younger audiences despite featuring suggestive or adult themes. By enforcing higher age barriers and requiring fresh disclosures, the platform aims to strengthen protections for minors alongside its expanding suite of parental controls. Developers face immediate adjustments to keep their offerings available on the global storefront.
Executives are positioning the company's base of more than 2.5 billion active devices to run both proprietary features and partner tools, including Google Gemini technology. Despite achieving record fiscal-year financial results, the tech giant warned that rising memory costs will pressure holiday profit margins. The strategy focuses on driving monetization through future hardware refreshes, subscription commissions, and paid tiers for server-dependent capabilities.