--- title: Composer learns to wait | daily.dev description: Composer 2.11 adds a 'cooldown' policy that blocks freshly published package versions for a configurable period, giving security researchers and maintainers... canonical: https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Composer learns to wait | daily.dev og:description: Composer 2.11 adds a 'cooldown' policy that blocks freshly published package versions for a configurable period, giving security researchers and maintainers... og:url: https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i og:image: https://api.daily.dev/og/posts/NyM6Tdo9I.png og:image:alt: Composer learns to wait og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Composer learns to wait **[PHPUnit Expert](https://daily.dev/sources/phpunit-expert)** · 19 min read · 0 upvotes · 0 comments ## Summary Composer 2.11 adds a 'cooldown' policy that blocks freshly published package versions for a configurable period, giving security researchers and maintainers time to catch malicious releases before installation. The period defaults to null, so the feature does nothing unless configured, for example a 7-day period under config.policy.cooldown. Composer counts from Packagist.org's published-time field, which package authors have no influence on. A second change lets custom dependency policies block versions during composer install, not just composer update, via a new block-scope setting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I configure a cooldown period for Composer package updates in Composer 2.11? Set config.policy.cooldown.period in composer.json, for example a 7-day period, which blocks newly published versions from being installed until that time passes. The period accepts a number plus unit (second, minute, hour, day, week) or an integer of seconds; relative phrases like 'tomorrow' are rejected. The default is null, meaning the cooldown does nothing unless explicitly configured. _Developers locking down dependency pipelines can track rollout details for policies like this on daily.dev._ ### Why does Composer's cooldown feature use published-time instead of the time field from composer.json? Composer 2.11 uses published-time because the time field is set by the package author or derived from a Git commit date, which can be backdated by anyone who compromises a repository. published-time is set by Packagist.org when it first makes a version available, so package authors have no influence over it, making it a trustworthy anchor for calculating cooldown windows. _Teams evaluating supply chain defenses can follow how trusted timestamps shape tools like Composer on daily.dev._ ### Can Composer's custom dependency policies block packages during composer install, not just composer update? Yes, Composer 2.11 adds a block-scope setting to custom dependency policies with three values: update (blocks during update, require and remove, the default), install (blocks only during install), and all (blocks in both). Previously only the built-in malware list could block during install, leaving a gap where organization-specific policy lists only applied during update operations. _Platform teams enforcing internal package rules can keep up with changes like block-scope on daily.dev._ ## Similar posts on daily.dev - [Malware Blocking and Dependency Policies in Composer 2.10](https://daily.dev/posts/malware-blocking-and-dependency-policies-in-composer-2-10-dqtvhtqmx) · Laravel News · 0 upvotes · 0 comments - [Composer's dependency policies](https://daily.dev/posts/composer-s-dependency-policies-ynq88kd1g) · Andrew Nesbitt · 0 upvotes · 0 comments - [Unverified](https://daily.dev/posts/unverified-tiojtlabj) · PHPUnit Expert · 0 upvotes · 0 comments - [Package Managers Need to Cool Down](https://daily.dev/posts/package-managers-need-to-cool-down-ee6vqq1u6) · Lobsters · 0 upvotes · 0 comments - [Dependency cooldowns turn you into a free-rider](https://daily.dev/posts/dependency-cooldowns-turn-you-into-a-free-rider-xqq71wkpm) · Cal Paterson · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Composer learns to wait","url":"https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i"},"datePublished":"2026-10-30T05:42:24.544Z","dateModified":"2026-10-30T12:33:44.512Z","description":"Composer 2.11 adds a 'cooldown' policy that blocks freshly published package versions for a configurable period, giving security researchers and maintainers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dbe29d2f1277e567318a3a80743843bd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dbe29d2f1277e567318a3a80743843bd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"PHPUnit Expert","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PHPUnit Expert","logo":"https://media.daily.dev/image/upload/s--FMZoysoG--/f_auto,q_auto/v1774964057/logos/phpunit-expert?_a=BAMAMiWQ0","url":"https://daily.dev/sources/phpunit-expert"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHPUnit Expert","item":"https://daily.dev/sources/phpunit-expert"},{"@type":"ListItem","position":3,"name":"Composer learns to wait"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/composer-learns-to-wait-nym6tdo9i#faq","mainEntity":[{"@type":"Question","name":"How do I configure a cooldown period for Composer package updates in Composer 2.11?","acceptedAnswer":{"@type":"Answer","text":"Set config.policy.cooldown.period in composer.json, for example a 7-day period, which blocks newly published versions from being installed until that time passes. The period accepts a number plus unit (second, minute, hour, day, week) or an integer of seconds; relative phrases like 'tomorrow' are rejected. The default is null, meaning the cooldown does nothing unless explicitly configured. Developers locking down dependency pipelines can track rollout details for policies like this on daily.dev."}},{"@type":"Question","name":"Why does Composer's cooldown feature use published-time instead of the time field from composer.json?","acceptedAnswer":{"@type":"Answer","text":"Composer 2.11 uses published-time because the time field is set by the package author or derived from a Git commit date, which can be backdated by anyone who compromises a repository. published-time is set by Packagist.org when it first makes a version available, so package authors have no influence over it, making it a trustworthy anchor for calculating cooldown windows. Teams evaluating supply chain defenses can follow how trusted timestamps shape tools like Composer on daily.dev."}},{"@type":"Question","name":"Can Composer's custom dependency policies block packages during composer install, not just composer update?","acceptedAnswer":{"@type":"Answer","text":"Yes, Composer 2.11 adds a block-scope setting to custom dependency policies with three values: update (blocks during update, require and remove, the default), install (blocks only during install), and all (blocks in both). Previously only the built-in malware list could block during install, leaving a gap where organization-specific policy lists only applied during update operations. Platform teams enforcing internal package rules can keep up with changes like block-scope on daily.dev."}}]} ```