Managing dependencies is more than running "composer update"
summary
Explains concrete rules: use composer update with explicit packages and --dry-run to see what will change, update one dependency at a time and run tests, always commit composer.lock for reproducibility, resolve lockfile merge conflicts by checking out the target branch’s composer.lock and reapplying the update, prefer private mirrors or Satis/private-packages to avoid availability outages, run composer licenses for legal checks, rely on semantic versioning but expect authors to sometimes mislabel majors and plan accordingly.
AI-written summary · about
chapters (7)
- 0:00Introduction to dependencies
- 2:34Managing dependency lifecycles
- 7:30Mitigating availability risks
- 12:42Addressing compatibility issues
- 20:00Practical updates and composer
- 24:39The role of the lock file
- 31:22Risk management and business
related talks
29mDependency Management: Where the Fork are We?
01h 07mTaking Maximum Advantage of Drupal Core's Composer Template
01h 04mImproving your Drupal 8 development workflow
38mKnow thy neighbours: dependency management done right.
37mKeep Your Dependencies in Check
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
38mAutomate or Stagnate: Surviving the Era of Continuous Updates
31mKeep your dependencies in check