Originally published at hafiz.dev

On 31 October I turned on Composer 2.11's new cooldown in a Laravel 13 project, set it to seven days, and ran composer update . It failed. Three days earlier Symfony had shipped a fix for CVE-2026-45070 in symfony/mime . The cooldown was holding the fix back, and Composer's advisory policy was blocking every older version. My project had nothing it was allowed to install.

The release notes do say the cooldown applies to security fixes too. What they can't show is how fast that bites. The cooldown gives malware scanners time to flag a malicious version before composer update ever offers it to you. But the same rule applies to the version that fixes your vulnerability.

I tried it on a clean Laravel project with Composer 2.11.1, with laravel/framework locked at 13.37.0. Here's what it changed, where it broke, and the setup I'd use. All output below is real.

What the cooldown does

Composer 2.11.0 shipped on 29 October, and 2.11.1 followed a day later.…