# Composer Update ## Purpose Analyze dependency updates after `composer update`, detect conflicts, and summarize relevant changes. --- ## Constraints - Apply @rules/php/core-standards.mdc - Apply @rules/php/dependency-selection.mdc — this skill primarily *bumps* existing packages (rule out of scope per its *Scope* section), but a bump frequently uncovers an upstream that has been archived or marked abandoned. When that happens, re-run the Activity gate + Compatibility gate against the suggested replacement (or against a fresh search if no replacement is documented) before recommending the migration. Never silently keep an archived / abandoned package in the lockfile just because the bump compiles. - Output Markdown only --- ## Execution ### 1. Update Context - Use output from `composer update` if available - Otherwise compare current `composer.lock` with the previous version ### 2. Detect Updated Packages - List all added or changed packages - Include version changes: `old → new` ### 3. Conflict Detection - Identify dependency conflicts from: - composer output - version constraint mismatches (`composer.json` vs `composer.lock`) - Summarize conflicts clearly (package → reason) - If none: state "No conflicts detected" ### 4. Changelog Extraction For each updated package: - Prefer: - `vendor/<package>/CHANGELOG*` - Fallback: - repository releases (GitHub/GitLab) - package homepage - Extract: - breaking changes - new features - important fixes - If unavailable: - state "No changelog found" ### 5. Suggested Follow-up - Recommend relevant checks: - run tests - `composer validate` - `composer audit` --- ## Output Format Use the template defined in `templates/update-report.md`. --- ## Principles - Focus on impactful changes, not noise - Highlight breaking changes first - Prefer local sources over remote - Be concise and actionable - Highlight security-related changes when present ## Output Humanization - Use [blader/humanizer](https://github.com/blader/humanizer) for all skill outputs to keep the text natural and human-friendly.

Composer Update

Purpose

Analyze dependency updates after composer update, detect conflicts, and summarize relevant changes.

Constraints

Apply @rules/php/core-standards.mdc
Apply @rules/php/dependency-selection.mdc — this skill primarily bumps existing packages (rule out of scope per its Scope section), but a bump frequently uncovers an upstream that has been archived or marked abandoned. When that happens, re-run the Activity gate + Compatibility gate against the suggested replacement (or against a fresh search if no replacement is documented) before recommending the migration. Never silently keep an archived / abandoned package in the lockfile just because the bump compiles.
Output Markdown only

Execution

1. Update Context

Use output from composer update if available
Otherwise compare current composer.lock with the previous version

2. Detect Updated Packages

List all added or changed packages
Include version changes: old → new

3. Conflict Detection

Identify dependency conflicts from:
- composer output
- version constraint mismatches (composer.json vs composer.lock)
Summarize conflicts clearly (package → reason)
If none: state "No conflicts detected"

4. Changelog Extraction

For each updated package:

Prefer:
- vendor/<package>/CHANGELOG*
Fallback:
- repository releases (GitHub/GitLab)
- package homepage
Extract:
- breaking changes
- new features
- important fixes
If unavailable:
- state "No changelog found"

5. Suggested Follow-up

Recommend relevant checks:
- run tests
- composer validate
- composer audit

Output Format

Use the template defined in `templates/update-report.md`.

Principles

Focus on impactful changes, not noise
Highlight breaking changes first
Prefer local sources over remote
Be concise and actionable
Highlight security-related changes when present

Output Humanization

Use blader/humanizer for all skill outputs to keep the text natural and human-friendly.