Posts tagged with dependencies
Composer 2.11 adds a cooldown dependency policy that withholds newly published package versions for a configurable period. The release also includes several security fixes and faster dependency resolution.
Read more [blog.packagist.com]
– github.com – Edit
When working in a big repository, you sometimes lose track of your required Composer packages. There may be so many packages you can't be sure if they are actually used or not. This tool can help to determine if you really are using a package.
Read more [github.com]
Join 9,500+ smart developers
Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.
No spam. Unsubscribe anytime. You can also follow me on X.
"If you are one of the *millions* who have downloaded a Spatie package, then you understand the quality that Freek aims for. The newsletter is of the same quality of any Spatie package you're using."
The best dependency manager just got a little bit better.
Read more [php.watch]
– stefanzweifel.io – Edit
Stefan Zweifel created a nice workflow to automatically merge dependabot PRs when all tests pass
Read more [stefanzweifel.io]
– twitter.com – Edit
Not sure if your dependencies are up-to-date? Run `composer outdated` and find out. ⚡️ pic.twitter.com/6ZShopPapn
— NUNO MADURO ➕ (@enunomaduro) December 3, 2019
Read more [twitter.com]
– twitter.com – Edit
#Laravel tip of the day: if you want to find out which of your composer.json packages have released newer versions, just run "composer outdated". You will get a full list with all information. pic.twitter.com/2FOw39TBr4
— Laravel Daily (@DailyLaravel) March 6, 2019
Read more [twitter.com]
– Edit
Jordan Scales examined the contents of the node_modules directory a discovered a lot of junk.
While code bloat continues to slow down our websites, drain our batteries, and make “npm install” slow for a few seconds, many developers like myself have decided to carefully audit the dependencies we bring into our projects. It’s time we as a community stand up and say enough is enough, this community belongs to all of us, and not just a handful of JavaScript developers with great hair.I decided to document my experiences in auditing my projects’ dependencies, and I hope you find the following information useful.
– Edit
An older but still relevant post by Evert Pot on why and how you should also test your packages with the lowest versions of it's dependencies.
In some projects, there may be packages lying around that are not the latest version. This could be because it introduced some BC break, or introduced a bug.If other packages also use the package that’s being held back, they may get an older version as a dependency.
So for package maintainers, they will want to find out if their package correctly works with the oldest package they claim to support.
https://evertpot.com/testing-composer-prefer-lowest/
EDIT: Here's another old, but also still relevant, blogpost on the subject by Cees-Jan Kiewiet:
https://blog.wyrihaximus.net/2015/06/test-lowest-current-and-highest-possible-on-travis/
– Edit
Climb checks your composer files to see which packages are outdated, regardless of your version constraints. Without Climb, there's no way of knowing if a package has a new major release unless you use a notification system like Gemnasium. Climb is one of those tools you just need to get on your tool belt.http://jenssegers.com/78/check-outdated-composer-packages-with-climb
