What changed
Composer 2.11.0 released October 29, 2026 with a configurable opt-in dependency cooldown, additional security hardening and removal of the deprecated dist-to-source fallback. Version 2.11.1 followed October 30. The cooldown holds back newly published versions during dependency resolution, rather than blocking existing lockfile installations.
Why it matters
A short waiting period gives malware detection systems time to flag hijacked package releases before they reach PHP projects. But legitimate urgent security fixes are also recent releases: an overly long cooldown can conflict with advisory policies and block updates. Private-package build pipelines may also depend on the removed fallback behavior.
What the cooldown actually does
Set config.policy.cooldown.period in composer.json, globally or through COMPOSER_POLICY_COOLDOWN_PERIOD. It is disabled by default. During composer update or require, newly published package versions remain ineligible until the configured age passes. Composer install using an existing lockfile still installs pinned versions. A full update may re-evaluate a locked package inside the cooldown.
Emergency patches can be withheld too
A published Laravel 13 reproduction using Composer 2.11.1 and a seven-day cooldown found a recently patched Symfony dependency could not be selected while older vulnerable versions were blocked by advisory policy. This is a single developer's reproducible test, not an independently established widespread outage. The --no-cooldown option bypasses the wait for an urgent operation without disabling the other policies.
Other security and migration changes
The 2.11 release also removes the option to fall back automatically from failed distribution archives to source checkouts, which may break private-repository CI setups relying on that behavior. Release notes describe fixes involving certificate validation, binary proxy paths and credentials in repository requests.
Limits and rollout advice
Cooldowns do not themselves identify malicious code; they only increase the opportunity for detection. Test repository publication timestamps, full dependency resolution, CI and emergency overrides. An excessive delay can make timely security patching harder.