composer show --latest lists everything with a newer version, which on a mature project is forty lines that all look equally urgent and are not.
# only what your constraints already allow — should always be empty
composer outdated --direct --minor-only
# everything, including major bumps you would have to opt into
composer outdated --directThe --minor-only list is the actionable one: those are upgrades your own constraints permit, so they should be zero after any composer update and a non-empty list means someone has been installing without updating. --direct hides transitive dependencies, which you cannot upgrade directly anyway. Run the first in CI and read the second monthly.