Managing dependencies is more than running "composer update"
summary
Covers concrete dependency practices for Composer: use composer update --dry-run to see proposed changes, update one package at a time (or use composer update <pkg> --with-dependencies), commit and treat composer.lock as authoritative, and resolve lockfile merge conflicts by checking out the base branch’s composer.lock and rerunning update. Recommends private package mirrors (Satis/Private Packagist) for availability, use composer licenses to audit licenses, formalize BC promises and bump major versions when breaking, and design plan B (async/backoff or SLA) for fragile external services.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:36What are Dependencies?
- 3:33What is Dependency Management?
- 4:47Dependency Assembly
- 7:15Dependency Change Management
- 9:29Risk Analysis: Availability
- 11:32Risk Reduction: Availability
- 16:41Risk Analysis: Compatibility
- 18:09Risk Reduction: (New) Dependencies
- 21:34Risk Reduction: Compatibility
- 28:14How do partial updates work?
- 33:06Commit The Lock File
- 34:13How to resolve lock merge conflicts?
- 37:20Risk Analysis: Compliance / Legal
- 39:21Risk Minimization: Compliance / Legal
- 41:29Assessing & Managing Risk
- 42:26Summary
