# Composer 2.11 can delay compromised package releases — and urgent security fixes

Composer 2.11 adds an opt-in release-age policy for PHP dependencies, reducing immediate exposure to hijacked packages while requiring a deliberate emergency-patch bypass.

Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.

- Status: Active
- Published: 2026-11-04T06:14:38+13:00
- Updated: 2026-11-04T06:14:38+13:00
- Categories: Web Development, PHP, Frameworks, Developer Tools
- Tags: Composer, dependency management, supply chain security
- Canonical HTML: https://beyondthe.news/dossiers/composer-2-11-dependency-cooldown-package-release-security

## What changed

Composer 2.11.0 released October 29, 2026 with a configurable opt-in dependency cooldown, additional security hardening and removal of the deprecated dist-to-source fallback. Version 2.11.1 followed October 30. The cooldown holds back newly published versions during dependency resolution, rather than blocking existing lockfile installations.

## Why it matters

A short waiting period gives malware detection systems time to flag hijacked package releases before they reach PHP projects. But legitimate urgent security fixes are also recent releases: an overly long cooldown can conflict with advisory policies and block updates. Private-package build pipelines may also depend on the removed fallback behavior.

## What the cooldown actually does

Set config.policy.cooldown.period in composer.json, globally or through COMPOSER_POLICY_COOLDOWN_PERIOD. It is disabled by default. During composer update or require, newly published package versions remain ineligible until the configured age passes. Composer install using an existing lockfile still installs pinned versions. A full update may re-evaluate a locked package inside the cooldown.

## Emergency patches can be withheld too

A published Laravel 13 reproduction using Composer 2.11.1 and a seven-day cooldown found a recently patched Symfony dependency could not be selected while older vulnerable versions were blocked by advisory policy. This is a single developer's reproducible test, not an independently established widespread outage. The --no-cooldown option bypasses the wait for an urgent operation without disabling the other policies.

## Other security and migration changes

The 2.11 release also removes the option to fall back automatically from failed distribution archives to source checkouts, which may break private-repository CI setups relying on that behavior. Release notes describe fixes involving certificate validation, binary proxy paths and credentials in repository requests.

## Limits and rollout advice

Cooldowns do not themselves identify malicious code; they only increase the opportunity for detection. Test repository publication timestamps, full dependency resolution, CI and emergency overrides. An excessive delay can make timely security patching harder.

## Key details

- 2.11.0 released October 29; 2.11.1 October 30, 2026.
- Cooldown is opt-in, disabled by default.
- Applies to dependency resolution, not ordinary locked installs.
- Emergency override: --no-cooldown.
- Removed dist-to-source fallback override.
- One independent Laravel test demonstrated a security-fix conflict.

## Builder takeaways

- Test Composer 2.11.1 in CI and with private repositories before rollout.
- Choose a modest release-age delay and document an emergency --no-cooldown procedure.
- Keep advisory and malware policies enabled.
- Check private repository metadata and full-update behavior.
- Audit dist-to-source fallback assumptions.

## What to watch

- New Composer patch releases and dependency-policy semantics.
- Independent measurements of malware detection timing.
- Compatibility and emergency-patch case studies.

## Uncertainties

- The published Laravel failure is one test, not an industry-wide incident.
- A delay cannot guarantee malicious packages are flagged.
- Private repository compatibility varies by metadata and build configuration.

## Sources

- [Composer configuration reference](https://getcomposer.org/doc/06-config.md) — Composer · primary documentation. Official policy configuration, scope and exceptions.
- [Composer CLI reference](https://github.com/composer/composer/blob/main/doc/03-cli.md) — Composer · primary documentation. Override flags and environment variables.
- [Composer 2.11 release analysis](https://rescuephp.com/news/composer-2-11-0-released-cooldown-policy-security-fixes-source-fallback-removed) — RescuePHP · specialist independent reporting · 2026-10-30T00:00:00+13:00. Release and security changes.
- [Laravel cooldown reproduction](https://dev.to/hafiz619/composer-211s-cooldown-in-a-laravel-app-safer-updates-except-when-the-update-is-the-security-fix-24e6) — DEV Community · independent test · 2026-10-31T00:00:00+13:00. One-project demonstration of urgent-fix trade-off.