v1.10.0

Report release-time provenance in the soak filter output

Builds on v1.9.0 (prefer Packagist's server-stamped published-time) by making the filter show which clock it judged each version by — so you can see, at a glance, how much of the filtering rested on tamper-resistant data versus the backdatable time field.

Without -v

A one-line breakdown is added to the summary:

[Soak Time] Filtered out 151 recent version(s) across 62 package(s). Run with -v for details.
[Soak Time]   Judged: 140 by server-stamped publish time, 11 by self-reported time (backdatable), 0 with no release date.

The self-reported count is the residual surface a backdating attacker could still aim at (versions Packagist served no published-time for).

With -v

Every dropped version is annotated with its source and date:

  symfony/console — dropped 1 version(s) newer than 168h or without a release date:
    8.2.x-dev  [published-time 2026-06-09 11:23, server-stamped]
  vendor/example — dropped 1 version(s) newer than 168h or without a release date:
    9.9.9  [time 2026-06-16 07:09, self-reported (backdatable)]

Notes

• A new ReleaseTime / ReleaseTimeSource pair, resolved once in PublishedTimeResolver::releaseTime(), is the single source of truth for both the filter decision and its reporting — they cannot disagree.
• The breakdown counts the filtered (dropped) versions — the recent ones inside the soak window — so the numbers stay signal, not noise.
• No change to the filter decision itself; this is pure observability on top of v1.9.0.

Full changelog: v1.9.0...v1.10.0