[kapersoft]

Composer 2.11 can withhold newly published package versions for a configurable cooldown before update and require will install them. This sets that period to 7 days.

"policy": {
    "cooldown": {
        "period": "7 days"
    }
}

composer install still installs the locked versions. A later composer update skips releases published in the last 7 days, including security fixes. Install one immediately with composer update --no-cooldown vendor/package.

The lock file content hash was refreshed with composer update --lock so Composer 2.11 does not treat the lock as outdated. Package versions were left as they are. The lock plugin API version is now 2.11.0, which is the Composer release that enforces this policy. phpstan/phpstan also gained a published-time from that lock refresh.

Verified with Composer 2.11.1:

• composer validate --strict passes
• composer normalize --dry-run reports composer.json is already normalized
• composer show --latest withholds phpstan/phpstan 2.3.5 and laravel/framework v13.40.0 because both are still inside the cooldown