PHPackages                             dereuromark/composer-prefer-lowest - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Testing & Quality](/categories/testing)
4. /
5. dereuromark/composer-prefer-lowest

ActiveLibrary[Testing & Quality](/categories/testing)

dereuromark/composer-prefer-lowest
==================================

Checks prefer-lowest more strictly. Add-on for CI.

0.1.10(4y ago)22504.1k↓14.5%2[1 issues](https://github.com/dereuromark/composer-prefer-lowest/issues)13MITPHPPHP >=7.3CI passing

Since Jan 3Pushed 5mo ago4 watchersCompare

[ Source](https://github.com/dereuromark/composer-prefer-lowest)[ Packagist](https://packagist.org/packages/dereuromark/composer-prefer-lowest)[ RSS](/packages/dereuromark-composer-prefer-lowest/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (3)Versions (12)Used By (13)

Composer Prefer Lowest Validator
================================

[](#composer-prefer-lowest-validator)

[![CI](https://github.com/dereuromark/composer-prefer-lowest/actions/workflows/ci.yml/badge.svg)](https://github.com/dereuromark/composer-prefer-lowest/actions/workflows/ci.yml)[![Latest Stable Version](https://camo.githubusercontent.com/a86ef8b27a542a3c5082e34f69e313132cf036ffc033c9a3f8b72a3c9a4edd8d/68747470733a2f2f706f7365722e707567782e6f72672f6465726575726f6d61726b2f636f6d706f7365722d7072656665722d6c6f776573742f762f737461626c652e737667)](https://packagist.org/packages/dereuromark/composer-prefer-lowest)[![Minimum PHP Version](https://camo.githubusercontent.com/b3532f10ecf4b1971c0cb39dfc1e15f300fc94ad3458b51af080b6979ef48cd7/687474703a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253345253344253230372e332d3838393242462e737667)](https://php.net/)[![License](https://camo.githubusercontent.com/03206c020d64abaf1d056fcd4e4bc09384b9645b2e013a4696b73a69ca3474b3/68747470733a2f2f706f7365722e707567782e6f72672f6465726575726f6d61726b2f636f6d706f7365722d7072656665722d6c6f776573742f6c6963656e73652e737667)](https://packagist.org/packages/dereuromark/composer-prefer-lowest)[![Coding Standards](https://camo.githubusercontent.com/dbabe22710e675cb88cd0b12196f1477e2376dea497332775692cf1359a75918/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f63732d5053522d2d322d2d522d79656c6c6f772e737667)](https://github.com/php-fig-rectified/fig-rectified-standards)[![Total Downloads](https://camo.githubusercontent.com/04ac52e9ec60acd0398d960388d0f2d0a2da1d6ab097f24a43f2ba517ec738fd/68747470733a2f2f706f7365722e707567782e6f72672f6465726575726f6d61726b2f636f6d706f7365722d7072656665722d6c6f776573742f642f746f74616c2e737667)](https://packagist.org/packages/dereuromark/composer-prefer-lowest)

This validator will strictly compare the specified minimum versions of your composer.json with the ones actually used by the `prefer-lowest` composer update command option.

This is useful for all libraries that want to make sure

- **the defined minimum of each dependency is actually still being tested**
- no silent regressions (like using too new methods of depending libraries) sneaked in

For details, see [Why and when is this useful?](https://www.dereuromark.de/2019/01/04/test-composer-dependencies-with-prefer-lowest). This has been built after Composer didn't have the [motivation](https://github.com/composer/composer/issues/7849) for it.

**A total must-have** for

- frameworks
- framework plugins/addons (and testing against the framework minors)
- custom libraries to be used by apps/projects which have at least one dependency to other libraries

It is somewhat important for the involved packages to follow semver here. Otherwise some of the comparison might be problematic.

This is not so useful for projects, as here there is no need to test against anything than latest versions already in use. Also, if your library has no dependencies, you can skip prefer-lowest checks as well as this validation.

Local Test-Run
--------------

[](#local-test-run)

You want to give it a quick test-spin for one of your libraries? See what results it yields?

```
composer update --prefer-lowest --prefer-dist --prefer-stable
composer require --dev --update-with-all-dependencies dereuromark/composer-prefer-lowest
vendor/bin/validate-prefer-lowest

```

If there is no output, that's good. `echo $?` should return `0` (success).

CI Installation
---------------

[](#ci-installation)

It is recommended to run only for CI and `composer update --prefer-lowest`. As such, it suffices to add it conditionally here.

E.g. for Travis CI:

```
php:
  - 7.3
  - 8.1

env:
  global:
    - DEFAULT=1

matrix:
  include:
    - php: 7.3
      env: PREFER_LOWEST=1

before_script:
  - if [[ $PREFER_LOWEST != 1 ]]; then composer install --prefer-source --no-interaction; fi
  - if [[ $PREFER_LOWEST == 1 ]]; then composer update --prefer-lowest --prefer-dist --prefer-stable --no-interaction; fi
  - if [[ $PREFER_LOWEST == 1 ]]; then composer require --dev dereuromark/composer-prefer-lowest; fi

script:
  - if [[ $DEFAULT == 1 ]]; then vendor/bin/phpunit; fi
  - if [[ $PREFER_LOWEST == 1 ]]; then vendor/bin/validate-prefer-lowest; fi

```

You can, of course, also directly include it into `require-dev`. After manually running `composer update --prefer-lowest` locally, you can also test this on your local computer then:

```
vendor/bin/validate-prefer-lowest

```

It returns the list of errors and exits with error code `1` if any violations are found. Otherwise it returns with success code `0`.

### Prefer stable

[](#prefer-stable)

Usually `composer update --prefer-lowest` suffices. Make sure you have `"prefer-stable": true` in your composer.json for this to work. Otherwise you might have to use the longer version as outlined above.

In general it is best to just use all flags for your CI script:

```
composer update --prefer-lowest --prefer-dist --prefer-stable --no-interaction

```

### Majors only

[](#majors-only)

If you want to only error the CI build for major constraint issues, use `--majors-only`/`-m` option:

```
vendor/bin/validate-prefer-lowest -m

```

The patch and minor issues will then be warnings only.

### Display only

[](#display-only)

If you want to just display the result in your CI report without failing the build, you could do:

```
vendor/bin/validate-prefer-lowest || true

```

### PHP version

[](#php-version)

In general: Use the minimum PHP version for `prefer-lowest` as defined in your composer.json.

This tool requires minimum **PHP 7.3**, as such make sure your library to test also runs on this (or higher) for the `prefer-lowest` CI job. At this point, with it being EOL already, you can and should not use any PHP version below 7.3 anyway, or provide support for it.

It is advised to also raise your composer.json entry for the min PHP version here. Use 7.3 or higher:

```
    "require": {
        "php": ">=7.3",

```

Local Composer Script Installation
----------------------------------

[](#local-composer-script-installation)

For local testing, when you do not want to modify your composer.json file, you can simple add this composer script:

```
"scripts": {
    ...
    "lowest": " validate-prefer-lowest",
    "lowest-setup": "composer update --prefer-lowest --prefer-stable --prefer-dist --no-interaction && cp composer.json composer.backup && composer require --dev --update-with-all-dependencies dereuromark/composer-prefer-lowest && mv composer.backup composer.json",

```

Then run `composer lowest-setup` to set up the script and finally `composer lowest` to execute.

TODOs
-----

[](#todos)

- Better version handling, especially around special cases like suffixes.

Help is greatly appreciated.

###  Health Score

45

—

FairBetter than 93% of packages

Maintenance47

Moderate activity, may be stable

Popularity46

Moderate usage in the ecosystem

Community23

Small or concentrated contributor base

Maturity52

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 95.5% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~103 days

Recently: every ~141 days

Total

11

Last Release

1659d ago

PHP version history (3 changes)0.1.0PHP >=5.6

0.1.8PHP >=7.2

0.1.10PHP >=7.3

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/39854?v=4)[Mark Scherer](/maintainers/dereuromark)[@dereuromark](https://github.com/dereuromark)

---

Top Contributors

[![dereuromark](https://avatars.githubusercontent.com/u/39854?v=4)](https://github.com/dereuromark "dereuromark (63 commits)")[![Chris53897](https://avatars.githubusercontent.com/u/7104259?v=4)](https://github.com/Chris53897 "Chris53897 (2 commits)")[![carusogabriel](https://avatars.githubusercontent.com/u/16328050?v=4)](https://github.com/carusogabriel "carusogabriel (1 commits)")

---

Tags

composercomposer-scriptscomposer-supportphp

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/dereuromark-composer-prefer-lowest/health.svg)

```
[![Health](https://phpackages.com/badges/dereuromark-composer-prefer-lowest/health.svg)](https://phpackages.com/packages/dereuromark-composer-prefer-lowest)
```

###  Alternatives

[vimeo/psalm

A static analysis tool for finding errors in PHP applications

5.8k77.5M6.7k](/packages/vimeo-psalm)[phan/phan

A static analyzer for PHP

5.6k11.2M1.1k](/packages/phan-phan)[phpspec/prophecy

Highly opinionated mocking framework for PHP 5.3+

8.5k551.7M682](/packages/phpspec-prophecy)[staabm/phpstan-dba

2912.3M2](/packages/staabm-phpstan-dba)[pact-foundation/pact-php

Enables consumer driven contract testing, following the PACT foundation principles.

2971.7M32](/packages/pact-foundation-pact-php)[staabm/phpstan-todo-by

1991.8M55](/packages/staabm-phpstan-todo-by)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)