composer-dependencies
Installation
SKILL.md
Composer Dependencies Update
Dependency updates are maintenance, not features. Do them regularly in small batches rather than rarely in large ones. Every update follows the same cycle: audit, update, verify, commit.
Core Principles
| Principle | Meaning |
|---|---|
| Changelog first | Before any major dependency update, search the web for the package's changelog or UPGRADE file, or ask the user for it. Never guess what changed |
| Security first | Run composer audit before and after every update. Vulnerabilities take priority over everything |
| Small batches | Update one package or one logical group at a time. Never update everything at once |
| Lock file is truth | Always commit composer.lock. Production uses composer install, never composer update |
| Verify before merging | Every update must pass the full test suite and static analysis before merging |
| Caret by default | Use ^ constraints for most dependencies. They balance stability with receiving fixes |