composer-dependencies

Name: composer-dependencies
Author: krzysztofsurdy

31installs1forks

How to install composer-dependencies?

krzysztofsurdy/code-virtuoso/composer-dependencies

$npx -y skills add krzysztofsurdy/code-virtuoso --skill composer-dependencies

Installs into the current project.

Summary

Composer dependency management playbook for safe, systematic package updates. Use when the user asks to update Composer dependencies, audit packages for security vulnerabilities, manage composer.lock, configure Dependabot or Renovate for automated updates, replace abandoned packa

Files · 1

View on GitHub

SKILL.md

1	# Composer Dependencies Update
2
3	Dependency updates are maintenance, not features. Do them regularly in small batches rather than rarely in large ones. Every update follows the same cycle: audit, update, verify, commit.
4
5	## Core Principles
6
7	\| Principle \| Meaning \|
8	\|---\|---\|
9	\| Changelog first \| Before any major dependency update, search the web for the package's changelog/UPGRADE file or ask the user to provide it - never guess what changed \|
10	\| Security first \| Run `composer audit` before and after every update - vulnerabilities take priority over everything \|
11	\| Small batches \| Update one package or one logical group at a time - never update everything at once \|
12	\| Lock file is truth \| Always commit `composer.lock` - production uses `composer install`, never `composer update` \|
13	\| Verify before merging \| Every update must pass the full test suite and static analysis before merging \|
14	\| Caret by default \| Use `^` constraints for most dependencies - it balances stability with receiving fixes \|
15
16	---
17
18	## Critical First Step: Read the Changelog
19
20	Before updating any dependency to a new major version, you MUST obtain the actual changelog:
21
22	1. Search the web for `{package-name} CHANGELOG` or `{package-name} UPGRADE guide` (e.g., `doctrine/orm UPGRADE.md github`)
23	2. Or ask the user to provide the changelog / release notes
24	3. Check the package's GitHub repository for `CHANGELOG.md`, `UPGRADE.md`, or release notes
25
26	This is non-negotiable for major updates. Each package has unique breaking changes that static skill knowledge cannot capture. For patch and minor updates, changelogs are recommended but not blocking.
27
28	---
29
30	## Update Strategies by Risk Level
31
32	\| Strategy \| Scope \| Risk \| Frequency \| Command \|
33	\|---\|---\|---\|---\|---\|
34	\| Patch only \| Bug fixes (1.2.3 -> 1.2.4) \| Lowest \| Weekly \| `composer update --patch-only` \|
35	\| Minor \| New features, backward-compatible (1.2 -> 1.3) \| Low \| Biweekly \| `composer update --minor-only` \|
36	\| Major \| Breaking changes possible (1.x -> 2.0) \| Highest \| Planned, one at a time \| `composer update vendor/package --with-all-dependencies` \|
37	\| Security \| Vulnerability fixes \| Urgent \| Immediately \| `composer audit` then targeted update \|
38
39	---
40
41	## Essential Commands
42
43	\| Command \| Purpose \|
44	\|---\|---\|
45	\| `composer outdated --direct` \| Show outdated direct dependencies (skip transitive) \|
46	\| `composer outdated --major-only` \| Show only packages with major updates available \|
47	\| `composer outdated --minor-only` \| Show only packages with minor updates available \|
48	\| `composer audit` \| Check locked versions against known security advisories \|
49	\| `composer why vendor/package` \| Show which packages depend on a given dependency \|
50	\| `composer why-not vendor/package 2.0` \| Show what prevents upgrading to a specific version \|
51	\| `composer update vendor/package --with-all-dependencies` \| Update a package and all its dependents \|
52	\| `composer bump` \| Raise lower bounds in `composer.json` to currently installed versions (apps only) \|
53	\| `composer validate --strict` \| Validate `composer.json` structure and constraints \|
54
55	---
56
57	## Security Auditing
58
59	### composer audit
60
61	Built into Composer since 2.4. Compares locked versions against GitHub Security Advisories and FriendsOfPHP databases.
62
63	```bash
64	# Check for known vulnerabilities
65	composer audit
66
67	# JSON output for CI parsing
68	composer audit --format=json
69	```
70
71	Returns non-zero exit code when vulnerabilities are found - use as a CI gate.
72
73	Since Composer 2.9 (November 2025), `composer update` and `composer require` automatically block installation of packages with known security advisories by default.
74
75	### roave/security-advisories
76
77	Preventive complement to `composer audit`. Declares `conflict` rules against all known vulnerable versions, preventing them from being installed.
78
79	```bash
80	composer require --dev roave/security-advisories:dev-latest
81	```
82
83	Must always be pinned to `dev-latest` (never a tagged version).
84
85	Quick check: `composer update --dry-run roave/security-advisories`
86
87	See [Update Workflow Reference](references/update-workflow.md) for the complete step-by-step update process.
88
89	---
90
91	## Version Constraints
92
93	\| Operator \| Example \| Range \| Use Case \|
94	\|---\|---\|---\|---\|
95	\| `^` (caret) \| `^1.2.3` \| `>=1.2.3 <2.0.0` \| Default for most dependencies \|
96	\| `~` (tilde) \| `~1.2.3` \| `>=1.2.3 <1.3.0` \| Conservative - patch updates only \|
97	\| `~` (minor) \| `~1.2` \| `>=1.2.0 <2.0.0` \| Same as `^1.2` in practic

People who liked this also viewed

6 picks

Type

composer-dependencies

31installs1forks

View on GitHub

How to install composer-dependencies?

krzysztofsurdy/code-virtuoso/composer-dependencies

$npx -y skills add krzysztofsurdy/code-virtuoso --skill composer-dependencies

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Composer Dependencies Update
2
3	Dependency updates are maintenance, not features. Do them regularly in small batches rather than rarely in large ones. Every update follows the same cycle: audit, update, verify, commit.
4
5	## Core Principles
6
7	\| Principle \| Meaning \|
8	\|---\|---\|
9	\| Changelog first \| Before any major dependency update, search the web for the package's changelog/UPGRADE file or ask the user to provide it - never guess what changed \|
10	\| Security first \| Run `composer audit` before and after every update - vulnerabilities take priority over everything \|
11	\| Small batches \| Update one package or one logical group at a time - never update everything at once \|
12	\| Lock file is truth \| Always commit `composer.lock` - production uses `composer install`, never `composer update` \|
13	\| Verify before merging \| Every update must pass the full test suite and static analysis before merging \|
14	\| Caret by default \| Use `^` constraints for most dependencies - it balances stability with receiving fixes \|
15
16	---
17
18	## Critical First Step: Read the Changelog
19
20	Before updating any dependency to a new major version, you MUST obtain the actual changelog:
21
22	1. Search the web for `{package-name} CHANGELOG` or `{package-name} UPGRADE guide` (e.g., `doctrine/orm UPGRADE.md github`)
23	2. Or ask the user to provide the changelog / release notes
24	3. Check the package's GitHub repository for `CHANGELOG.md`, `UPGRADE.md`, or release notes
25
26	This is non-negotiable for major updates. Each package has unique breaking changes that static skill knowledge cannot capture. For patch and minor updates, changelogs are recommended but not blocking.
27
28	---
29
30	## Update Strategies by Risk Level
31
32	\| Strategy \| Scope \| Risk \| Frequency \| Command \|
33	\|---\|---\|---\|---\|---\|
34	\| Patch only \| Bug fixes (1.2.3 -> 1.2.4) \| Lowest \| Weekly \| `composer update --patch-only` \|
35	\| Minor \| New features, backward-compatible (1.2 -> 1.3) \| Low \| Biweekly \| `composer update --minor-only` \|
36	\| Major \| Breaking changes possible (1.x -> 2.0) \| Highest \| Planned, one at a time \| `composer update vendor/package --with-all-dependencies` \|
37	\| Security \| Vulnerability fixes \| Urgent \| Immediately \| `composer audit` then targeted update \|
38
39	---
40
41	## Essential Commands
42
43	\| Command \| Purpose \|
44	\|---\|---\|
45	\| `composer outdated --direct` \| Show outdated direct dependencies (skip transitive) \|
46	\| `composer outdated --major-only` \| Show only packages with major updates available \|
47	\| `composer outdated --minor-only` \| Show only packages with minor updates available \|
48	\| `composer audit` \| Check locked versions against known security advisories \|
49	\| `composer why vendor/package` \| Show which packages depend on a given dependency \|
50	\| `composer why-not vendor/package 2.0` \| Show what prevents upgrading to a specific version \|
51	\| `composer update vendor/package --with-all-dependencies` \| Update a package and all its dependents \|
52	\| `composer bump` \| Raise lower bounds in `composer.json` to currently installed versions (apps only) \|
53	\| `composer validate --strict` \| Validate `composer.json` structure and constraints \|
54
55	---
56
57	## Security Auditing
58
59	### composer audit
60
61	Built into Composer since 2.4. Compares locked versions against GitHub Security Advisories and FriendsOfPHP databases.
62
63	```bash
64	# Check for known vulnerabilities
65	composer audit
66
67	# JSON output for CI parsing
68	composer audit --format=json
69	```
70
71	Returns non-zero exit code when vulnerabilities are found - use as a CI gate.
72
73	Since Composer 2.9 (November 2025), `composer update` and `composer require` automatically block installation of packages with known security advisories by default.
74
75	### roave/security-advisories
76
77	Preventive complement to `composer audit`. Declares `conflict` rules against all known vulnerable versions, preventing them from being installed.
78
79	```bash
80	composer require --dev roave/security-advisories:dev-latest
81	```
82
83	Must always be pinned to `dev-latest` (never a tagged version).
84
85	Quick check: `composer update --dry-run roave/security-advisories`
86
87	See [Update Workflow Reference](references/update-workflow.md) for the complete step-by-step update process.
88
89	---
90
91	## Version Constraints
92
93	\| Operator \| Example \| Range \| Use Case \|
94	\|---\|---\|---\|---\|
95	\| `^` (caret) \| `^1.2.3` \| `>=1.2.3 <2.0.0` \| Default for most dependencies \|
96	\| `~` (tilde) \| `~1.2.3` \| `>=1.2.3 <1.3.0` \| Conservative - patch updates only \|
97	\| `~` (minor) \| `~1.2` \| `>=1.2.0 <2.0.0` \| Same as `^1.2` in practic

People who liked this also viewed

6 picks

Type