Composer Prefer Lowest Laravel Package

Getting Started

Add the package as a dev dependency to your reusable library or plugin:

composer require --dev dereuromark/composer-prefer-lowest

Then update your composer.json to include the script:

{
  "scripts": {
    "prefer-lowest": "ComposerPreferLowest\\Command\\PreferLowestCommand::run"
  }
}

Run it locally to verify lowest-version compatibility:

composer prefer-lowest

This will generate a new composer.lock (temporarily) with lowest-compatible versions and run your tests (phpunit, etc.) against that install—without modifying your main composer.lock.

Implementation Patterns

• CI Integration: Add composer prefer-lowest as a separate job in your CI (e.g., GitHub Actions, GitLab CI), distinct from your main composer install && vendor/bin/phpunit run. Keep it fast: skip slow steps like linting, just install and test.
• Multi-version Matrix: Pair with PHP version testing—e.g., run lowest-version tests on PHP 7.4 and 8.0 to catch cross-version BC breaks.
• Custom Test Command: Extend via config in composer.json to override the test command if you don’t use phpunit directly:

  {
    "extra": {
      "prefer-lowest": {
        "test-command": "vendor/bin/phpunit --test-suite lowest"
      }
    }
  }
  

• Non-destructive Operation: It uses a temporary composer.json (with "minimum-stability": "dev" and "prefer-lowest": true) and leaves your main config untouched.

Gotchas and Tips

• Lock File Side Effects: While it avoids modifying your composer.lock, ensure your CI cache or cache-clear logic doesn’t inadvertently persist the temporary lock. Consider disabling Composer cache for the prefer-lowest job.
• Dependency Version Bounds: Ensure your require constraints use realistic lower bounds (e.g., "php": "^7.4 || ^8.0" is safer than "php": "7.4.*"). The tool exposes constraints that are technically allowed but may be too loose.
• False Positives: Tests failing on lowest versions may be legitimate (e.g., reliance on array_unshift(..., ...) behavior in newer PHP), but may also indicate missing composer require "monolog/monolog:^2.0" where ^1.0 would’ve sufficed. Always audit.
• Outdated Package: Last released in 2021; verify it still works cleanly with Composer 2.2+ (especially since prefer-lowest became a built-in flag in Composer 2.2). You might now prefer composer install --prefer-lowest + CI test—but this package adds automation, isolation, and configurability. Benchmark both approaches.
• No Built-in Test Retry: It assumes your test command is idempotent. Wrap flaky tests (e.g., DB-dependent) with retry logic in your test command if needed.