Composer Upgrade

Upgrade Workflow

Follow this sequence when upgrading a PHP project:

1. Check for security issues → composer audit — fixes here are highest priority
2. Identify what's outdated → composer outdated --format=json
3. Prioritize — packages with CVEs AND outdated go first; see references/audit.md
4. Diagnose blockers → composer why-not vendor/package version — note any sub-packages blocking the update
5. Trace dependencies → composer why vendor/package
6. Update packages → composer update vendor/package — if blocked, include identified blockers: composer update vendor/package blocker/one blocker/two
7. Test
8. Harden constraints → composer bump (applications only)
9. Re-audit → composer audit to confirm all advisories are resolved

See references/commands.md for full flag reference, including global flags for non-interactive use (--no-interaction --no-progress --no-ansi). See references/upgrade-workflow.md for detailed strategies, including merge conflict resolution. See references/audit.md for security audit details, severity tiers, and how to build a prioritized package list.