Find Outdated Composer Dependencies Using "composer outdated"

Introduction

When building your PHP web applications, it's important to keep your dependencies up-to-date and also to prevent installing Composer dependencies with known security vulnerabilities. This helps you to ensure that your application is secure and that you're benefiting from the latest features and bug fixes.

But it's really easy to fall behind on your dependency updates between general day-to-day development tasks. Thankfully, Composer provides us with a handy tool that you can use to get an overview of which packages you're using that have available updates.

In this Quickfire article, we're going to take a quick look at the composer outdated command to help you find outdated packages in your PHP project.

The "composer outdated" Command

You can run the composer outdated command to find out which of your dependencies have available updates.

You can execute the command by running the following in your PHP project's root directory:

        
1composer outdated    

By default, the command will display the packages that have newer versions available, along with the current version that you're using. The dependencies are split into two separate categories:

• Direct dependencies - these are packages that you've required in your composer.json file.
• Transitive dependencies - these are packages that are required by your direct dependencies, but not by you directly.

If a minor or patch version of the dependency, Composer will display the new version in red. If a major version of the dependency is available, the new version will be displayed in yellow.

Here's an example of the output you might see when running the composer outdated command:

As we can see in the image, the composer outdated command has displayed the packages that have newer versions available.

So in our example above, we can see that the phpunit/phpunit dependency that we're requiring in our composer.json file is currently on 10.5.17 and has a major version upgrade to 11.3.1 available.

We can also see that we have some transitive dependencies that have a major, minor, and patch upgrades available.

Command Options

The composer outdated command has a few options that you can use to filter the output:

--all

You can use the --all option to display all the dependencies in your project, including those that are up-to-date. This can be useful if you want to see all the dependencies in your project in one place and get an overview of which packages require updates and which are running the latest versions.

You can use it like so:

        
1composer outdated --all    

The output may look something like this:

If the version numbers are displayed in green, this means the version we currently have installed is the current up-to-date version. As an example, we can see that the jonpurvis/profanify dependency is up to date.

As a side note, I've actually got an article about how you can use Profanify in your PHP projects to prevent profanity in your code. You can check it out here: Profanify: Prevent Profanity in Your PHP Codebase

--direct

You can use the --direct option to only display the direct dependencies in your project.

This can be useful if you're only interested in seeing the packages that you've directly required in your composer.json file.

You can use it like so:

        
1composer outdated --direct    

The output may look something like this:

--major-only

If you only want to see the packages that have a major version available, you can use the --major-only option.

You can use it like so:

        
1composer outdated --major-only    

--minor-only

If you only want to see the packages that have a minor version available, you can use the --minor-only option.

You can use it like so:

        
1composer outdated --minor-only    

--patch-only

If you only want to see the packages that have a patch version available, you can use the --patch-only option.

You can use it like so:

        
1composer outdated --patch-only    

Conclusion

Hopefully, this article has given you a quick overview of the composer outdated command and how you can use it to find outdated packages in your PHP project.

If you enjoyed reading this post, you might be interested in checking out my 220+ page ebook "Battle Ready Laravel" which covers similar topics in more depth.

Or, you might want to check out my other 440+ page ebook "Consuming APIs in Laravel" which teaches you how to use Laravel to consume APIs from other services.

If you're interested in getting updated each time I publish a new post, feel free to sign up for my newsletter below.

Keep on building awesome stuff! 🚀