📦 composer-outdated-changes

Inspect outdated Composer dependencies with inline release notes, SemVer impact categorization ([MAJOR], [MINOR], [PATCH]), and compare diff links before updating your project.

Powered by Termwind for stunning terminal output.

---

The Problem & The Solution

• composer outdated tells you which packages are outdated, but gives no context on breaking changes or what actually changed.
• pyrech/composer-changelogs only displays changelogs after composer update has already run.
• composer-outdated-changes runs before you update:
  1. Inspects outdated packages locally (composer outdated --format=json).
  2. Categorizes version bumps according to Semantic Versioning (MAJOR, MINOR, PATCH).
  3. Formats exact repository comparison links (/compare/v1.0.0...v2.0.0) for GitHub, GitLab, and Bitbucket.
  4. Automatically pulls inline release notes from GitHub's REST API without requiring an API key.
  5. Renders a Tailwind-styled terminal card report, with optional Markdown and JSON outputs for CI/PR comments.

---

Terminal Preview

---

Installation

Option 1: Zero-Install via CPX (Recommended)

Run instantly without modifying your composer.json:

cpx spodnet/composer-outdated-changes

Option 2: As a Dev-Dependency

composer require --dev spodnet/composer-outdated-changes

# Run binary
./vendor/bin/composer-outdated-changes

Option 3: Global Installation

composer global require spodnet/composer-outdated-changes

composer-outdated-changes

---

CLI Options & Usage

# Check direct dependencies (default)
composer-outdated-changes

# Include transitive / sub-dependencies
composer-outdated-changes --all
composer-outdated-changes -a

# Filter by SemVer impact level
composer-outdated-changes --major-only   # Only breaking changes
composer-outdated-changes --minor-only   # Minor feature updates
composer-outdated-changes --patch-only   # Bug fixes & patches

# Target a different directory / repository
composer-outdated-changes --path=/path/to/another-project

# 100% Offline Mode (Instant, skips HTTP release note fetching)
composer-outdated-changes --no-changelog

# Filter by package name
composer-outdated-changes guzzle
composer-outdated-changes --filter=symfony

# Alternative output formats
composer-outdated-changes --format=markdown   # Great for GitHub Actions PR comments
composer-outdated-changes --format=json       # Great for scripts and automation

---

Zero-Network Discovery & API Limits

1. Repository URLs: Discovered 100% locally from composer outdated --format=json and vendor/composer/installed.json without any network calls.
2. Compare & Release URLs: Formatted offline via platform-specific generators (GitHub, GitLab, Bitbucket).
3. Release Notes: Fetched directly from GitHub's public REST API. No API key is required (allows 60 unauthenticated requests/hour). If a GITHUB_TOKEN is present in your environment, it is automatically used to lift the limit to 5,000 req/hr.
4. Offline Guarantee: When --no-changelog is specified, zero external HTTP requests are made.

---

Quality & Development Standards

Built in adherence to Spodnet/quality-control:

• PHP 8.4+ with declare(strict_types=1);
• Pint code formatting (composer lint)
• PHPStan static analysis at Level 8 (composer analyse)
• Pest PHP test suite (composer test)

# Run tests
composer test

# Check code formatting
composer lint:check

# Run PHPStan
composer analyse

# Run all checks
composer check

---

License

MIT License. See LICENSE for details.