Context
Composer has no native "reject a package published in the last N days" mechanism, unlike npm's .npmrc min-release-age. composer/composer#12847 (and the related #12552, #12877) track the upstream request — a PR is milestoned for Composer 2.11 but unreleased as of 2026-08-17.
What the fleet uses in the meantime
Two third-party install-time Composer plugins were evaluated as a stopgap and rejected:
encoredigitalgroup/heimdall — closest functional match (minimum_age + vendor trust-list), but declares "php": "^8.4". Every core app's CI matrix tests php-test-versions: ["8.3", "8.4"]; this would break composer install on the PHP 8.3 leg fleet-wide.zingstudios/composer-delay — php ^8.1-compatible, has the vendor-exclude feature needed, but like heimdall is a ~3-month-old single-maintainer package. Installing a young, code-executing Composer plugin fleet-wide specifically to guard against young/malicious dependencies was left to a human decision rather than defaulted into.
Instead, the fleet uses GitHub Dependabot's native cooldown: key on the composer package-ecosystem entry in every app's .github/dependabot.yml:
cooldown:
default-days: 2
exclude:
- "conduction/*"This is a weaker control than npm's install-time .npmrc guard — it only delays Dependabot's own automated PRs, not a developer running composer update or CI installing a package a human just required. Policed by gate 93 (composer-cooldown-config, conduction/hydra-gates — ConductionNL/.github#488).
See ADR-093 (proposed — ConductionNL/hydra#591) and ConductionNL/hydra openspec/changes/composer-dependency-cooldown for the full rationale and fleet rollout.
Close this issue when
composer/composer#12847 (or equivalent) ships, and the fleet has migrated from this Dependabot-only control to Composer's native minimum-release-age mechanism — retiring the Dependabot-cooldown-only gap this issue tracks.
🤖 Filed by Claude Code at Ruben's request.
Context
Composer has no native "reject a package published in the last N days" mechanism, unlike npm's
.npmrcmin-release-age. composer/composer#12847 (and the related #12552, #12877) track the upstream request — a PR is milestoned for Composer 2.11 but unreleased as of 2026-08-17.What the fleet uses in the meantime
Two third-party install-time Composer plugins were evaluated as a stopgap and rejected:
encoredigitalgroup/heimdall— closest functional match (minimum_age + vendor trust-list), but declares"php": "^8.4". Every core app's CI matrix testsphp-test-versions: ["8.3", "8.4"]; this would breakcomposer installon the PHP 8.3 leg fleet-wide.zingstudios/composer-delay—php ^8.1-compatible, has the vendor-exclude feature needed, but like heimdall is a ~3-month-old single-maintainer package. Installing a young, code-executing Composer plugin fleet-wide specifically to guard against young/malicious dependencies was left to a human decision rather than defaulted into.Instead, the fleet uses GitHub Dependabot's native
cooldown:key on thecomposerpackage-ecosystem entry in every app's.github/dependabot.yml:This is a weaker control than npm's install-time
.npmrcguard — it only delays Dependabot's own automated PRs, not a developer runningcomposer updateor CI installing a package a human just required. Policed by gate 93 (composer-cooldown-config,conduction/hydra-gates— ConductionNL/.github#488).See ADR-093 (proposed — ConductionNL/hydra#591) and
ConductionNL/hydraopenspec/changes/composer-dependency-cooldownfor the full rationale and fleet rollout.Close this issue when
composer/composer#12847(or equivalent) ships, and the fleet has migrated from this Dependabot-only control to Composer's nativeminimum-release-agemechanism — retiring the Dependabot-cooldown-only gap this issue tracks.🤖 Filed by Claude Code at Ruben's request.