pyrech/composer-changelogs
Composer plugin that displays changelogs for updated dependencies after composer update or install. It fetches release notes from GitHub, GitLab, and other sources so you can review what changed without leaving the terminal.
pyrech/composer-changelogs is a Composer plugin, not a Laravel package — there is no service provider, no facade, and nothing to publish into config/. It hooks Composer's install/update events and prints a changelog summary (package, old → new version, and a link to the diff/release notes) after a dependency change. That is the entire surface area, and it is exactly what makes it useful on a Laravel team.
composer require --dev pyrech/composer-changelogs.php -v locally and every CI matrix entry before bumping; on 7.4/8.0 you must stay on ^2.1.composer.json:
"config": { "allow-plugins": { "pyrech/composer-changelogs": true } }
composer update in a branch, read the report at the end of the output, and open the diff links for anything crossing a major version. This is a five-second sanity check before you push a lock file that Dependabot/Renovate generated for you.extra.changelogs in the root composer.json) and composer list to see the command the plugin registers, so you can regenerate the report without doing another update.composer.lock. Treat the post-update output as a review checklist for lock-file PRs — the most common win is catching a transitive major bump that a bot PR hides behind "Bump the composer group".post-install-cmd/post-update-cmd, so it runs on composer install in CI too. That's noise in pipelines — run production/composer installs with --no-plugins --no-dev, and leave the plugin for dev machines and the dedicated "dependency update" job.extra.changelogs via environment variables in CI rather than committing them. Without a token, public GitHub API calls from shared runners get rate-limited and the report degrades to bare version numbers.composer update branch → read the report → triage majors manually → merge patches blindly. Combine with composer outdated --direct for a second opinion on what is actually stale.^2.1 nothing breaks, and if you're already on 8.1+ the only visible difference is a quiet PHP 8.5 run (the release fixes a ReflectionProperty::setAccessible() deprecation). No new config keys, no changed output format.allow-plugins entry, --no-plugins, -q/-n suppressing the output, or running composer install from an already-current lock (nothing changed → nothing to report). Check with composer update -vvv before assuming the plugin is broken.source/support URLs, or it is a private mirror/fork, the plugin falls back to plain version numbers. Don't read a link-less line as "unimportant".composer update on a mature Laravel app produces a very long table. Use the exclude/limit options under extra.changelogs to drop internal packages that publish no changelogs, and keep the report short enough that people actually read it.composer.json + environment. If you need a different format for CI, capture the Composer output into a file and post-process it rather than trying to hook the plugin.require — always require-dev. Libraries that ship it as a hard dependency force it on every consumer's Composer run.How can I help you explore Laravel packages today?