Guzzle can do this out of the box! This technique is also used to power some of the checks in Oh Dear.
PHP
Composer 2.11
Composer 2.11 adds a cooldown dependency policy that withholds newly published package versions for a configurable period. The release also includes several security fixes and faster dependency resolution. Read more