Members

Nice supply-chain security win for PHP devs: Composer 2.11 (released 3 November) adds an optional cooldown policy. You set a period like “7 days” in composer.json, and Composer won’t pull in package versions published more recently than that, giving the community time to spot and pull any malicious release. You can exempt your own packages and bypass it with –no-cooldown for urgent security fixes. It doesn’t affect composer install from a lock file.More here: Cooldown Dependency Policy now in Composer 2.11Would you switch this on for client projects? What cooldown period feels right to you?