PHPackages                             cotonet/soak-time - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. cotonet/soak-time

ActiveComposer-plugin[Security](/categories/security)

cotonet/soak-time
=================

Protects against supply chain attacks by filtering recently published packages.

v1.1.0(4mo ago)313.7k↑2592.5%[1 issues](https://github.com/cotonet-resiliencia-digital/composer-soak-time/issues)PHPPHP ^7.4 || ^8.0 || ^8.1 || ^8.2 || ^8.3 || ^8.4 || ^8.5

Since Mar 31Pushed 4mo ago1 watchersCompare

[ Source](https://github.com/cotonet-resiliencia-digital/composer-soak-time)[ Packagist](https://packagist.org/packages/cotonet/soak-time)[ RSS](/packages/cotonet-soak-time/feed)WikiDiscussions main Synced 6d ago

READMEChangelog (4)Dependencies (2)Versions (5)Used By (0)

Cotonet Soak Time 🛡️
====================

[](#cotonet-soak-time-️)

A Composer plugin designed to mitigate **Supply Chain Attacks** by enforcing a "soak time" (minimum age) on all installed package versions.

Recently published packages or updates can sometimes carry malicious code (zero-days or compromised maintainer accounts). This plugin acts as a shield by completely hiding recent releases from the Composer solver, ensuring you only install mature, community-vetted code.

💡 How it works
--------------

[](#-how-it-works)

This plugin intercepts Composer's `PRE_POOL_CREATE` event. It analyzes the release dates of all requested packages (including deep transitive dependencies) and drops any version that is newer than your configured threshold.

Composer will then gracefully resolve your dependencies using older, safer versions, avoiding the "dependency hell" of manual conflict resolution.

📦 Installation
--------------

[](#-installation)

Install this plugin as a development dependency:

```
composer require --dev cotonet/soak-time
```

*Or install it globally to protect all your local projects:*

```
composer global require cotonet/soak-time
```

⚙️ Configuration
----------------

[](#️-configuration)

By default, the plugin enforces a minimum age of **168 hours (7 days)**.

Customize this in the `extra` section of your project's `composer.json`:

```
{
    "extra": {
        "soak-time-hours": 360
    }
}
```

### Whitelisting Packages

[](#whitelisting-packages)

Some packages, like security advisories or internal company packages, need to be updated constantly and should bypass the soak time filter. You can allow them permanently by adding an array of package names to `soak-time-whitelist` in your `composer.json`:

```
{
    "extra": {
        "soak-time-hours": 168,
        "soak-time-whitelist": [
            "roave/security-advisories",
            "your-company/internal-package"
        ]
    }
}
```

🚨 Emergency Bypass (Security Patches)
-------------------------------------

[](#-emergency-bypass-security-patches)

If you need to install a critical security patch that was released just a few hours ago, you can bypass the filter using the `SOAK_TIME_SKIP` environment variable:

**Linux / macOS:**

```
SOAK_TIME_SKIP=1 composer update vendor/package-name
```

**Windows (PowerShell):**

```
$env:SOAK_TIME_SKIP=1; composer update vendor/package-name
```

🔍 Debugging
-----------

[](#-debugging)

To see which versions are being dropped, run Composer with the verbose flag (`-v`):

```
composer update -v
```

📄 License
---------

[](#-license)

This project is licensed under the MIT License.

###  Health Score

44

—

FairBetter than 90% of packages

Maintenance69

Regular maintenance activity

Popularity31

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity55

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~2 days

Total

4

Last Release

129d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/57aee85efbeaa3a718060d4e6704112e7ebb2a0b07bd658246a2934784fafbaa?d=identicon)[cotonet-resiliencia-digital](/maintainers/cotonet-resiliencia-digital)

---

Top Contributors

[![cotonet-resiliencia-digital](https://avatars.githubusercontent.com/u/254997756?v=4)](https://github.com/cotonet-resiliencia-digital "cotonet-resiliencia-digital (5 commits)")

### Embed Badge

![Health badge](/badges/cotonet-soak-time/health.svg)

```
[![Health](https://phpackages.com/badges/cotonet-soak-time/health.svg)](https://phpackages.com/packages/cotonet-soak-time)
```

###  Alternatives

[phpro/grumphp

A composer plugin that enables source code quality checks.

4.3k17.0M1.1k](/packages/phpro-grumphp)[drupal/core-composer-scaffold

A flexible Composer project scaffold builder.

5346.5M599](/packages/drupal-core-composer-scaffold)[drupal/core-vendor-hardening

Hardens the vendor directory for when it's in the docroot.

175.0M54](/packages/drupal-core-vendor-hardening)[drupal/core-project-message

Adds a message after Composer installation.

2125.4M213](/packages/drupal-core-project-message)[phpro/grumphp-shim

GrumPHP Phar distribution

284.9M348](/packages/phpro-grumphp-shim)[altis/core

Core module for Altis

19233.0k4](/packages/altis-core)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)