> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: New Composer Cooldown Period!
- URL: https://securinglaravel.com/security-tip-new-composer-cooldown-period/
- Published: 2026-10-30T09:07:14.000Z
- Updated: 2026-10-30T09:11:41.000Z
- Description: [Tip #136] Composer 2.11 adds the long-awaited cooldown period option, designed to give malware scanners and researchers more time to identify and block malicious versions before they arrive in your dependency updates.
- Author: Stephen Rees-Carter
- Tags: Security Tips, Dependencies, Composer

Let's take a step back from PHP2Shell this week, since if you're like me, you're probably sick of hearing about it everywhere. I promise I will come back to it, as there are some useful things we can, and should, be doing, but instead let's turn to an exciting new release from the Composer team!

[Composer 2.11.0 was released today](https://blog.packagist.com/composer-2-11-release/?ref=securinglaravel.com), which includes the new cooldown dependency policy! We talked about this [way back in June](https://securinglaravel.com/security-tip-safely-updating-dependencies/), with the `min-release-age` feature in NPM and confirmation that it was coming to Composer too. A few months later, and it has arrived!

Composer introduced malware blocks back in 2.10, which blocked installation of package versions marked as malicious, however this requires malicious versions to be flagged after they are published - which introduces a window where a malicious version remains unflagged and installable.

The **cooldown period** is designed to narrow or close that window by delaying when your `composer update` will pull down a new version. This gives malware scanners a chance to identify and flag malicious versions before it is possible for them to reach you.

[As per the release announcement](https://blog.packagist.com/composer-2-11-release/?ref=securinglaravel.com#cooldown-periods-withholding-new-releases), you can configure it through the `config.policy` within your `composer.json` file:

```json
{
    "config": {
        "policy": {
            "cooldown": {
                "period": "1 day"
            }
        }
    }
}
```

and accepts a string like `1 day`, `6 hours` (supporting `second`, `minute`, `hour`, `day`, or `week`), or an integer number of seconds.

It works in either your project `composer.json` or global `composer.json`, or via the environment variable `COMPOSER_POLICY_COOLDOWN_PERIOD`.

⚠️

There is one important caveat with this new feature: ****Security Fixes do not bypass the cooldown period.**  
  
Composer has no way to verify if a new version is a legitimate security fix or a malicious version, so everything is delayed. When you need to install a security fix quickly (such as when it's flagged by `composer audit`), you can manually skip the cooldown with: `composer update --no-cooldown vendor/package`.

**So how long do I set it for?**

That is a very good question. 

A lot of malicious versions are detected within minutes, so an hour would protect against a lot. However that relies on automated scanning picking it up and correctly reporting it, while the more careful malicious versions are likely to take a few hours to be detected.

You could bump it to a week, but then that's an entire week where you **won't** receive security updates. That opens your app up to a very different risk.

My suggestion is to try with `1 day`, and keep an eye out for security fixes via `composer audit`.

**Wait, how do I update Composer?**

`composer self-update` should do it in most environments. 🙂

---

***Found this security tip useful?* 👍**  
[*Subscribe now*](#/portal/signup) *to get weekly* [*Security Tips*](https://securinglaravel.com/tag/tips/) *straight to your inbox - practical, actionable advice to help you build safer apps.*

***Want to go deeper?* 🤓**  
*Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*. Your support directly funds my security work in the Laravel community.* 🥰

**Need a second set of eyes on your code?** 
*Book a* [*Laravel Security Audit and Penetration Test*](https://valorinsecurity.com/?ref=securinglaravel.com) *\- or, for something more focused, a lighter-weight* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*.*

*Finally, connect with me on* [*Twitter*](http://twitter.com/valorin?ref=securinglaravel.com)*,* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*,* [*phpc.social*](https://phpc.social/@valorin?ref=securinglaravel.com)*, and* [*LinkedIn*](https://www.linkedin.com/in/stephen-rees-carter/?ref=securinglaravel.com)*.*