Support the ongoing development of Laravel.io →
Article Hero Image

Find Outdated Composer Dependencies Using "composer outdated"

19 Aug, 2024 4 min read

Photo by Tasha Marie on Unsplash

Introduction

When building your PHP web applications, it's important to keep your dependencies up-to-date and also to prevent installing Composer dependencies with known security vulnerabilities. This helps you to ensure that your application is secure and that you're benefiting from the latest features and bug fixes.

But it's really easy to fall behind on your dependency updates between general day-to-day development tasks. Thankfully, Composer provides us with a handy tool that you can use to get an overview of which packages you're using that have available updates.

In this Quickfire article, we're going to take a quick look at the composer outdated command to help you find outdated packages in your PHP project.

The "composer outdated" Command

You can run the composer outdated command to find out which of your dependencies have available updates.

You can execute the command by running the following in your PHP project's root directory:

composer outdated  

By default, the command will display the packages that have newer versions available, along with the current version that you're using. The dependencies are split into two separate categories:

  • Direct dependencies - these are packages that you've required in your composer.json file.
  • Transitive dependencies - these are packages that are required by your direct dependencies, but not by you directly.

If a minor or patch version of the dependency, Composer will display the new version in red. If a major version of the dependency is available, the new version will be displayed in yellow.

Here's an example of the output you might see when running the composer outdated command:

composer outdated output

As we can see in the image, the composer outdated command has displayed the packages that have newer versions available.

So in our example above, we can see that the phpunit/phpunit dependency that we're requiring in our composer.json file is currently on 10.5.17 and has a major version upgrade to 11.3.1 available.

We can also see that we have some transitive dependencies that have major, minor, and patch upgrades available.

Command Options

The composer outdated command has a few options that you can use to filter the output:

--all

You can use the --all option to display all the dependencies in your project, including those that are up-to-date. This can be useful if you want to see all the dependencies in your project in one place and get an overview of which packages require updates and which are running the latest versions.

You can use it like so:

composer outdated --all

The output may look something like this:

composer outdated --all output

If the version numbers are displayed in green, this means the version we currently have installed is the current up-to-date version. As an example, we can see that the jonpurvis/profanify dependency is up to date.

As a side note, I've actually got an article about how you can use Profanify in your PHP projects to prevent profanity in your code. You can check it out here: Profanify: Prevent Profanity in Your PHP Codebase

--direct

You can use the --direct option to only display the direct dependencies in your project.

This can be useful if you're only interested in seeing the packages that you've directly required in your composer.json file.

You can use it like so:

composer outdated --direct

The output may look something like this:

composer outdated --direct output

--major-only

If you only want to see the packages that have a major version available, you can use the --major-only option.

You can use it like so:

composer outdated --major-only

--minor-only

If you only want to see the packages that have a minor version available, you can use the --minor-only option.

You can use it like so:

composer outdated --minor-only

--patch-only

If you only want to see the packages that have a patch version available, you can use the --patch-only option.

You can use it like so:

composer outdated --patch-only

Conclusion

Hopefully, this article has given you a quick overview of the composer outdated command and how you can use it to find outdated packages in your PHP project.

If you enjoyed reading this post, you might be interested in checking out my 220+ page ebook "Battle Ready Laravel" which covers similar topics in more depth.

Or, you might want to check out my other 440+ page ebook "Consuming APIs in Laravel" which teaches you how to use Laravel to consume APIs from other services.

If you're interested in getting updated each time I publish a new post, feel free to sign up for my newsletter.

Keep on building awesome stuff! 🚀

Last updated 1 month ago.

driesvints liked this article

1
Like this article? Let the author know and give them a clap!
ash-jc-allen (Ash Allen) I'm a freelance Laravel web developer from Preston, UK. I maintain the Ash Allen Design blog and get to work on loads of cool and exciting projects 🚀

Other articles you might like

Article Hero Image November 18th 2024

Laravel Custom Query Builders Over Scopes

Hello 👋 Alright, let's talk about Query Scopes. They're awesome, they make queries much easier to r...

Read article
Article Hero Image November 19th 2024

Access Laravel before and after running Pest tests

How to access the Laravel ecosystem by simulating the beforeAll and afterAll methods in a Pest test....

Read article
Article Hero Image November 11th 2024

🍣 Sushi — Your Eloquent model driver for other data sources

In Laravel projects, we usually store data in databases, create tables, and run migrations. But not...

Read article

We'd like to thank these amazing companies for supporting us

Your logo here?

Laravel.io

The Laravel portal for problem solving, knowledge sharing and community building.

© 2024 Laravel.io - All rights reserved.