0.10.0

Released 2026-09-13

A v1 repository such as wpackagist rotating a provider file's hash no longer fails an update: viv reloads the repository's packages.json and retries once, as Composer does

--metadata-ttl <seconds> on update, add and rm, or VIV_METADATA_TTL: skip revalidating cached package metadata younger than the window, so a second update shortly after the first makes no metadata requests. Off by default (#191)

viv update serves each repository's packages.json from the cache for ten minutes without a request, as Composer does, loads several repositories concurrently, and reads the lock while the repositories load; the setup step before the metadata closure drops from 117 ms to 5 ms (#190)
viv update asks for security advisories while the metadata closure is still loading, instead of after it; Laravel's warm update drops from 0.75 s to 0.65 s (#189)
Cold install extracts an archive with more than 2,000 entries across up to eight threads, and creates each directory once instead of per file; drupal/recommended-project's cold install from a local mirror falls from 1263 ms to 728 ms, ahead of riff's 744 ms (#193)