How to prevent local composer upgrades from breaking your live environment

For the scope of this article, I'll assume you have (basic) experience with composer and are familiar with the way dependencies are defined.

When you want to upgrade your dependencies, composer is smart enough to take your PHP version into account: it'll only upgrade every package to compatible versions. Let's say your local environment uses PHP 7.4, but the live environment is still on 7.2. Any upgrade will work with your local 7.4 but might break on 7.2 when being pushed to live.

Telling composer about the PHP version of your live environment

{
    // requires (...)
    "config": {
        "platform": {
            "php": "8.0" // Version from the live environment
        }
    }
}

Composer will now know about this version, and never upgrade a package to an incompatible version. So any local upgrades can be safely executed!

If your live PHP version is outdated, also consider upgrading! This will bring both performance and security improvements.

Often running into problems with different environment settings? Options exist that will create a complete container to run your application in, that will replicate the live environment - they need some setup though. (e.g. Docker)

Have you got other composer tips to share? Eager to hear about them!