Freek.dev

When working in a big repository, you sometimes lose track of your required Composer packages. There may be so many packages you can't be sure if they are actually used or not. This tool can help to determine if you really are using a package.

Read more [github.com]

The best dependency manager just got a little bit better.

Read more [php.watch]

Stefan Zweifel created a nice workflow to automatically merge dependabot PRs when all tests pass

Read more [stefanzweifel.io]

Not sure if your dependencies are up-to-date? Run `composer outdated` and find out. ⚡️ pic.twitter.com/6ZShopPapn

— NUNO MADURO ➕ (@enunomaduro) December 3, 2019

Read more [twitter.com]

#Laravel tip of the day: if you want to find out which of your composer.json packages have released newer versions, just run "composer outdated". You will get a full list with all information. pic.twitter.com/2FOw39TBr4

— Laravel Daily (@DailyLaravel) March 6, 2019

Read more [twitter.com]

Jordan Scales examined the contents of the node_modules directory a discovered a lot of junk.

While code bloat continues to slow down our websites, drain our batteries, and make “npm install” slow for a few seconds, many developers like myself have decided to carefully audit the dependencies we bring into our projects. It’s time we as a community stand up and say enough is enough, this community belongs to all of us, and not just a handful of JavaScript developers with great hair.

I decided to document my experiences in auditing my projects’ dependencies, and I hope you find the following information useful.

https://medium.com/friendship-dot-js/i-peeked-into-my-node-modules-directory-and-you-wont-believe-what-happened-next-b89f63d21558

Read more

An older but still relevant post by Evert Pot on why and how you should also test your packages with the lowest versions of it's dependencies.

In some projects, there may be packages lying around that are not the latest version. This could be because it introduced some BC break, or introduced a bug.

If other packages also use the package that’s being held back, they may get an older version as a dependency.

So for package maintainers, they will want to find out if their package correctly works with the oldest package they claim to support.

https://evertpot.com/testing-composer-prefer-lowest/

EDIT: Here's another old, but also still relevant, blogpost on the subject by Cees-Jan Kiewiet:

https://blog.wyrihaximus.net/2015/06/test-lowest-current-and-highest-possible-on-travis/

Read more

Climb checks your composer files to see which packages are outdated, regardless of your version constraints. Without Climb, there's no way of knowing if a package has a new major release unless you use a notification system like Gemnasium. Climb is one of those tools you just need to get on your tool belt.

Read more