Download the PHP package terminal42/composer-lock-validator without Composer
On this page you can find all versions of the php package terminal42/composer-lock-validator. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download terminal42/composer-lock-validator
More information about terminal42/composer-lock-validator
Files in terminal42/composer-lock-validator
Package composer-lock-validator
Short Description A library to validate a composer.lock file against your local Composer instance
License MIT
Informations about the package composer-lock-validator
Composer lock file validator
This library allows to compare a given composer.lock
file against your local Composer instance.
You can use it to e.g. ensure a provided composer.lock
does not contain any foreign packages (not required by your Composer
instance - aka composer.json
) or package URLs that have been tampered with. It also detects removed packages that
should be present.
Usage:
Partial validation / validation against existing composer.lock
When you run composer update
as a partial update (e.g. composer update <vendor/package> --with-dependencies
), Composer
will not update the composer.lock
information of all the other packages. Hence, validating will probably fail because one
of the other packages have experienced metadata updates in the meantime (new URL, probably abandoned
, different branch-aliases
etc.).
In such a case, you might want to add your already existing composer.lock
file as additional source of truth. Every
package in the composer.lock
you want to validate then has to either match the metadata of the repositories or the entry
of an already existing composer.lock
. Simply pass the data of the existing composer.lock
as second argument:
All versions of composer-lock-validator with dependencies
composer/composer Version ^2.8
composer/semver Version ^3.4
sebastian/diff Version ^5.1