PHPackages                             zingstudios/composer-delay - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. zingstudios/composer-delay

ActiveComposer-plugin[Utility & Helpers](/categories/utility)

zingstudios/composer-delay
==========================

Composer plugin that blocks installation of packages newer than a configurable threshold.

v1.0.1(1mo ago)133MITPHPPHP ^8.1

Since May 27Pushed 1mo agoCompare

[ Source](https://github.com/ZingStudios/composer-delay)[ Packagist](https://packagist.org/packages/zingstudios/composer-delay)[ Docs](https://github.com/ZingStudios/composer-delay)[ RSS](/packages/zingstudios-composer-delay/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (3)Versions (3)Used By (0)

composer-delay
==============

[](#composer-delay)

Composer plugin that refuses to install package versions newer than a configurable threshold (default: 3 days). Similar in spirit to pnpm's `minimumReleaseAge`. Defends against supply-chain attacks where a malicious release is published and pulled before maintainers can react.

How it works
------------

[](#how-it-works)

Subscribes to Composer's `pre-pool-create` event and filters too-new versions out of the candidate pool **before** the dependency solver runs. The solver then picks the newest acceptable version that still satisfies your constraints. If no acceptable version exists, Composer reports a normal "could not find a version matching" error and the plugin's warning above it explains why.

Install
-------

[](#install)

You can install the plugin either globally (protects every project you work on) or per-project (protects just one project, including for teammates and CI). Both can coexist.

### Globally

[](#globally)

```
composer global require zingstudios/composer-delay
```

The plugin then applies to every Composer command that user runs.

### Per project

[](#per-project)

Run these in the project directory:

```
composer require --dev zingstudios/composer-delay
```

This commits the repository entry and the dependency into the project's `composer.json`, so teammates and CI pick up the protection automatically on their next `composer install`.

### Allow the plugin to run

[](#allow-the-plugin-to-run)

Since Composer 2.2, plugins must be explicitly allowed by each project's `composer.json`. Add this to any project you want protected:

```
{
  "config": {
    "allow-plugins": {
      "zingstudios/composer-delay": true
    }
  }
}
```

If you don't, Composer will prompt the first time it sees the plugin and write your answer into `composer.json`. Make sure to answer "yes" — answering "no" disables the plugin for that project. This applies whether the plugin is installed globally or per-project.

Configure
---------

[](#configure)

In any project's `composer.json`:

```
{
  "extra": {
    "composer-delay": {
      "days": 3,
      "exclude": [
        "zingstudios/*",
        "symfony/*"
      ]
    }
  }
}
```

- **`days`** — minimum age in days. Defaults to `3`. Set to `0` to disable.
- **`exclude`** — list of package name patterns to skip the check for. Supports `fnmatch` globs (e.g. `vendor/*`). Case-insensitive. Excluded packages are also allowed when their release date is missing.

If a configuration block is absent, the plugin still runs with default settings.

Behavior notes
--------------

[](#behavior-notes)

- **Fallback is automatic.** If `^2.0` resolves to a too-new `2.5.0`, the plugin removes `2.5.0` from the pool and the solver falls back to the next acceptable version (e.g. `2.4.0`). You'll see a warning, not a failure.
- **Platform packages are always ignored.** PHP itself, `ext-*`, `lib-*`, and Composer's own meta packages (`composer`, `composer-plugin-api`, `composer-runtime-api`), plus the root project, are skipped — they don't come from Packagist and don't carry release dates by design.
- **Missing release dates are treated as blocked.** Path repositories and some VCS configurations report no release date; add those packages to `exclude` to allow them.
- **Lockfile installs can fail.** `composer install` from a lockfile that pins a too-new version will fail, by design. Run `composer update ` to re-resolve against the filtered pool.
- **One-off bypass.** Either bump `days: 0` temporarily, add the package to `exclude`, or `composer global remove zingstudios/composer-delay` and reinstall after.

Development
-----------

[](#development)

```
composer install
vendor/bin/phpunit
```

###  Health Score

39

—

LowBetter than 84% of packages

Maintenance88

Actively maintained with recent releases

Popularity12

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

58d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/192182b53bdc607fe61bc44dff64bac2e57312aba4a5a87fdd02a6caa6774a64?d=identicon)[zingstudios](/maintainers/zingstudios)

---

Top Contributors

[![zing-ben](https://avatars.githubusercontent.com/u/196084362?v=4)](https://github.com/zing-ben "zing-ben (5 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/zingstudios-composer-delay/health.svg)

```
[![Health](https://phpackages.com/badges/zingstudios-composer-delay/health.svg)](https://phpackages.com/packages/zingstudios-composer-delay)
```

###  Alternatives

[symfony/runtime

Enables decoupling PHP applications from global state

74298.8M1.1k](/packages/symfony-runtime)[drupal/core-composer-scaffold

A flexible Composer project scaffold builder.

5345.4M570](/packages/drupal-core-composer-scaffold)[drupal/core-project-message

Adds a message after Composer installation.

2124.7M205](/packages/drupal-core-project-message)[sandersander/composer-link

Adds ability to link local packages for development with composer

98457.9k](/packages/sandersander-composer-link)[phpro/grumphp-shim

GrumPHP Phar distribution

294.7M342](/packages/phpro-grumphp-shim)[lullabot/drainpipe

An automated build tool to allow projects to have a set standardized operations scripts.

43785.5k4](/packages/lullabot-drainpipe)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)