composer outdated –direct is the only version worth reading

composer outdated on a real project lists two hundred packages, almost all of them transitive dependencies you did not choose and cannot upgrade independently.

$ composer outdated --direct
laravel/framework    v5.8.38  v6.0.4   The Laravel Framework.
phpunit/phpunit      7.5.20   8.4.1    The PHP Unit Testing framework.
symfony/console      v4.2.12  v4.3.5   Eases the creation of CLI apps

$ composer outdated --direct --minor-only     # what is safe to take now

--direct restricts it to what is in your own composer.json, which is the list somebody can actually act on. --minor-only is the weekly version: patch and minor upgrades within the current major, which under semver should be safe and in practice usually are. Running the unrestricted form once a quarter is still worth it, because a transitive package that has gone unmaintained is a thing to know about before a security advisory tells you.