Goal
Deliver a weekly Composer dependency audit summary.
Loop
Kickoff prompt:
/loop 7d Start the "Composer Dependency Audit Weekly" loop.
Goal: deliver a weekly Composer dependency audit summary.
Between iterations run: composer outdated --direct || true
Exit when: summary is posted with recommended upgrades.
Step 1: Run composer outdated and composer audit, categorize updates, and propose a safe upgrade plan.
Run this in the target project:
composer outdated --direct || true
Also run the Composer security audit:
composer audit || true
If there is no composer.json, stop and report that the current directory is not a Composer/PHP project.
Report
Summarize the result with:
- Current package manager evidence, such as
composer.json,composer.lock, and framework hints like Laravel packages. - Outdated direct dependencies grouped by patch, minor, and major updates.
- Security advisories from
composer audit, grouped by severity, if audit output is available. - Recommended safe upgrade order, starting with low-risk patch and minor updates.
- Breaking-change risks, required code changes, PHP version constraints, or framework compatibility concerns for major updates.
- Exact verification commands the project should run after upgrades.
Keep the report direct. Do not apply upgrades unless the user asks you to do the upgrade work.
Guardrails
- Do not modify the check command or exit criteria to force success.
- Do not skip, disable, or bypass checks to make the audit look clean.
- If package metadata is missing, dependency resolution fails, or audit output is blocked by registry/authentication issues, stop and report the blocker.