Download the PHP package nowo-tech/composer-update-helper without Composer

Composer Update Helper

⭐ Found this useful? Install from Packagist and give the repo a star on GitHub if it helps you.

Generates composer require commands from outdated dependencies. Works with any PHP project: Symfony, Laravel, Yii, CodeIgniter, Slim, Laminas, etc.

This bundle is FrankenPHP worker mode friendly.

Features

• ✅ Works with any PHP project
• ✅ Separates production and development dependencies
• ✅ Shows ignored packages with available versions
• ✅ Force include packages: Override ignore list to force specific packages to be included
• ✅ Multi-framework support with version constraints:
  • Symfony: respects extra.symfony.require
  • Laravel: respects laravel/framework + illuminate/* versions
  • Yii: respects yiisoft/yii2 version
  • CakePHP: respects cakephp/cakephp version
  • Laminas: respects laminas/* versions
  • CodeIgniter: respects codeigniter4/framework version
  • Slim: respects slim/slim version
• ✅ Compares versions to avoid unnecessary updates
• ✅ Dependency compatibility checking: Automatically detects and prevents dependency conflicts before suggesting updates
• ✅ Transitive dependency suggestions: When conflicts are detected, automatically suggests updating required transitive dependencies with ready-to-use commands
• ✅ Conflict Impact Analysis: Analyzes which packages would be affected by updating conflicting packages (optional with --show-impact flag)
• ✅ Save impact analysis: Save impact analysis to file with --save-impact flag
• ✅ Can execute commands directly with --run flag
• ✅ Automatic installation via Composer plugin
• ✅ Release information and changelogs: Shows GitHub release links and changelog previews for outdated packages
• ✅ Progress indicators: Shows loading messages during long-running operations (dependency checking, fallback search, etc.)
• ✅ Help option: Built-in --help flag for comprehensive usage information
• ✅ Verbose and Debug modes: -v, --verbose and --debug options for troubleshooting and detailed information
• ✅ Multiple file extensions: Supports both .yaml and .yml extensions for configuration files
• ✅ Performance optimized: Emojis and common elements are optimized for better performance
• ✅ Lightweight architecture: Script delegates complex logic to PHP in vendor, keeping the repo script lightweight and maintainable
• ⚠️ Internationalization (i18n) (DEVELOPMENT MODE): Multi-language support for output messages with automatic language detection

Version information

Supported PHP versions follow composer.json (>=8.1 <8.6). Release history is in docs/CHANGELOG.md.

Installation

After installation, two files will be copied to your project root:

• generate-composer-require.sh - The lightweight wrapper script (delegates complex logic to PHP in vendor)
• generate-composer-require.yaml - Configuration file for ignored and included packages (only created if doesn't exist)

Note: These files should be committed to your repository so they're available to all team members. The plugin will remove any old .ignore.txt entries from .gitignore if they exist.

Wrapper updates: On first install, generate-composer-require.sh is copied to your project root. On later composer update runs, the plugin does not overwrite a local wrapper that differs from the package copy unless you opt in:

When opt-in is disabled (default), Composer shows a comment with MD5 hashes if the wrapper differs. See Configuration.

Architecture

The script uses a lightweight architecture for better maintainability:

• generate-composer-require.sh (in your repo): A lightweight wrapper script (about 350 lines; size may change between releases) that handles:

  • Command-line argument parsing
  • Configuration file detection
  • Executing composer outdated
  • Calling the PHP processor
  • Displaying formatted output from PHP
  • Extracting and executing commands for --run flag
• process-updates.php (in vendor): Contains the heavy processing logic (about 900 lines; size may change between releases), including:
  • Package processing and filtering
  • Framework detection and version constraints
  • Release information fetching
  • Command generation
  • Output formatting (emojis, sections, formatting, etc.)

The script automatically detects process-updates.php in vendor/nowo-tech/composer-update-helper/bin/ and uses it. This architecture ensures:

• ✅ Lightweight script in your repo: Easy to read and understand
• ✅ Complex logic in vendor: Automatically updated with composer update
• ✅ Better maintainability: Clear separation of concerns
• ✅ Automatic detection: No configuration needed

Requirements

• PHP >=8.1 <8.6
• Composer 2.x

Configuration

The script searches for configuration files in the current directory (where composer.json is located). It supports both .yaml and .yml extensions, with .yaml taking priority.

Edit generate-composer-require.yaml to configure which packages to ignore or force include during updates, and set default values for command-line options:

💡 Tip: Command-line arguments always override YAML configuration. For example, if you set show-release-info: true in YAML but run ./generate-composer-require.sh --no-release-info, the release info will be disabled for that run.

For detailed configuration options including language settings, dependency checking, and backward compatibility, see Configuration Guide.

For framework support details, see Framework Support.

Usage

Basic Usage

Example output:

Note: By default, release information is not shown (no API calls are made). Use --release-info or --release-detail to enable it.

Available options:

• --run - Execute suggested commands automatically
• --release-info - Show release information (summary with links)
• --release-detail - Show full release changelog for each package (implies --release-info)
• --no-release-info - Skip release information section (default behavior)
• --show-impact, --impact - Show impact analysis for conflicting packages (disabled by default)
• --save-impact - Save impact analysis to composer-update-impact.txt file (implies --show-impact)
• -v, --verbose - Show verbose output (configuration files, packages, etc.)
• --debug - Show debug information (very detailed, includes file paths, parsing, etc.)
• -h, --help - Show help message

For detailed usage information, see Usage Guide.

Packagist Integration

Composer Update Helper fetches package information from Packagist to analyze dependencies and find compatible versions. Here's how it works:

How It Works

The tool uses a two-tier approach for fetching package information:

1. Primary Method: Direct Packagist API calls (https://packagist.org/packages/{package}.json)

   • Fast and efficient for most use cases
   • Used for: package requirements, versions, abandoned status, maintainer info, alternative package search
2. Fallback Method: composer show command
   • Automatically used when Packagist API is unavailable or returns incomplete data
   • Respects your project's repository configuration in composer.json
   • Supports mirrors, private repositories, and custom repository setups

Improving Packagist Access

Using Packagist Mirrors

If you're experiencing slow API responses or rate limiting, you can configure a Packagist mirror in your composer.json:

The fallback method (composer show) will automatically use your configured mirror.

Using Private Repositories

For private packages or internal repositories, simply configure them in your composer.json:

When the Packagist API doesn't have information about these packages, the tool automatically falls back to composer show, which respects your repository configuration.

Performance Considerations

• API Rate Limiting: Packagist doesn't enforce strict rate limits, but excessive requests may be throttled. The tool includes proper user-agent headers and reasonable timeouts (5 seconds).

• Offline Mode: If you're working offline or behind a firewall, the tool will fall back to composer show, which uses Composer's local cache when available.

• Caching: Composer caches package metadata automatically. Running composer update periodically ensures your cache is fresh, improving fallback performance.

💡 Tip: If you're using a VPN or behind a corporate firewall, configuring a Packagist mirror or ensuring composer show works will provide the best experience.

Related Packages

PHP Quality Tools

For Rector / PHP-CS-Fixer / Twig-CS-Fixer configs with automatic framework detection, use PHP Quality Tools (nowo-tech/php-quality-tools). Code Review Guardian is abandoned and should not be installed on new projects.

Composer Update Helper keeps dependencies current; PHP Quality Tools keeps style and static-analysis configs in sync with the framework.

Documentation

• Installation
• Configuration
• PSR evaluation (REQ-CS-007)
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• GitHub Actions CI requirements
• Framework support
• Update cases and scenarios
• Testing
• Implementation roadmap
• Development
• Branching
• I18N strategy

Tests and coverage

• Tests: PHPUnit (tests/Unit, tests/Integration).
• PHP: 100% line coverage on src/ (refresh with make test-coverage; gate with make coverage-check; minimum gate ≥99%).
• TS/JS: N/A
• Python: N/A

License

The MIT License (MIT). Please see LICENSE for more information.

Author

Created by Héctor Franco Aceituno at Nowo.tech