composer outdated on a real project lists two hundred packages, almost all of them transitive dependencies you did not choose and cannot upgrade independently. –direct restricts it to…
6.0’s only real breaking change is that the global str_ and array_ functions are gone, and the replacement is one Composer package away. Installing the compatibility package is…
Caching the installed directories means a stale cache silently ships the wrong dependency versions; caching the package manager’s download cache does not. Keying on the lock files means…
An application resolved against PHP 7.3 locally and deployed to a 7.2 server fails at some arbitrary point in the request, in a library, with an error nobody…
composer.json describes what is acceptable; composer.lock describes what was tested. Deploys that run update rather than install are resolving fresh on every release and shipping something no one…
Installing a package now writes configuration, adds environment variables and may register a bundle, and the reasonable first reaction is to want to know what it did. The…