v1.9.0

Prefer Packagist's server-stamped published-time for soak time

The freshness filter now prefers Packagist's published-time over the time field when deciding whether a version has aged past the soak window.

Why it matters

time is the tag's committer timestamp — whoever publishes a release controls it and can backdate it, making a fresh malicious version look mature and slip straight past the soak window. published-time is stamped by the registry at publish and cannot be moved earlier, so it closes that bypass.

The field is dropped by Composer's ArrayLoader and never reaches the package objects, so the plugin reads it back from the repository metadata cache that Composer populates while building the solver pool — before the filter runs.

Behavior

• Preferred when present, with fallback to time for releases predating the field and for non-Packagist sources (Satis, VCS, artifact) that don't emit it.
• Can only tighten the filter, never loosen it — every failure path falls back to the package's own release date.
• The integrity/drift layer is unchanged; it keys on the content-addressed source reference, not timestamps.

Verified end-to-end against live Packagist: the resolver matched the authoritative published-time for 753/753 cross-checked symfony/console versions, and the filter correctly drops a version whose published-time is fresh despite a backdated time.

Full changelog: v1.8.0...v1.9.0