PHPackages                             franciscoernestoteixeira/show-dependencies - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [CLI & Console](/categories/cli)
4. /
5. franciscoernestoteixeira/show-dependencies

ActiveLibrary[CLI & Console](/categories/cli)

franciscoernestoteixeira/show-dependencies
==========================================

CLI tool to list installed Composer dependencies with their actual installed versions (from composer.lock or vendor/).

1.0.0(3mo ago)01MITPHPPHP >=5.6

Since Mar 8Pushed 3mo agoCompare

[ Source](https://github.com/franciscoernestoteixeira/show-dependencies)[ Packagist](https://packagist.org/packages/franciscoernestoteixeira/show-dependencies)[ Docs](https://github.com/franciscoernestoteixeira/show-dependencies)[ RSS](/packages/franciscoernestoteixeira-show-dependencies/feed)WikiDiscussions main Synced 3w ago

READMEChangelogDependenciesVersions (2)Used By (0)

show-dependencies
=================

[](#show-dependencies)

A simple CLI tool to list the **installed `require`** and **`require-dev`** packages of a PHP/Composer project with their **actual installed versions** — read from `composer.lock` (preferred) or directly from `vendor/`.

It outputs:

- A human-readable table
- A JSON excerpt you can paste straight back into your `composer.json`

---

Why?
----

[](#why)

When maintaining projects, `composer.json` often lists version **ranges** (like `^4.0`), but sometimes you need to pin the **exact versions that are actually installed** — for example, when `composer.lock` has been accidentally deleted or was never committed, and `composer install` would otherwise upgrade everything.

This tool reads `composer.lock` when available, or falls back to scanning `vendor/`, and matches only the packages you declared in your own `composer.json`.

---

Requirements
------------

[](#requirements)

RequirementMinimum versionPHP5.6 or higher (up to PHP 8.x)ComposerAny recent versionPHP and Composer must both be available on your system `PATH`.
See the installation guides below if you need to set them up first.

---

Installing PHP and Composer
---------------------------

[](#installing-php-and-composer)

### 🪟 Windows

[](#-windows)

**PHP**

1. Download the latest PHP zip for Windows from .
    Choose the **Thread Safe** x64 zip.
2. Extract it to a permanent folder, for example `C:\php`.
3. Add `C:\php` to your system `PATH`:

    - Open **Start → Search → "Edit the system environment variables"**
    - Click **Environment Variables**
    - Under **System variables**, select `Path` → **Edit → New**
    - Add `C:\php` → **OK**
4. Open a new terminal and verify:

    ```
    php --version

    ```

**Composer**

Download and run the official installer from .
The Windows installer (`Composer-Setup.exe`) handles everything automatically, including adding Composer to `PATH`.

Verify:

```
composer --version

```

---

### 🍎 macOS

[](#-macos)

**PHP**

macOS ships with PHP, but it may be outdated. The recommended approach is [Homebrew](https://brew.sh):

```
brew install php
```

Verify:

```
php --version
```

**Composer**

```
brew install composer
```

Or install manually:

```
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
php -r "unlink('composer-setup.php');"
sudo mv composer.phar /usr/local/bin/composer
```

Verify:

```
composer --version
```

---

### 🐧 Linux (Debian / Ubuntu)

[](#-linux-debian--ubuntu)

**PHP**

```
sudo apt update
sudo apt install php php-cli
```

For other distributions, use the equivalent package manager (`yum`, `dnf`, `pacman`, etc.).

Verify:

```
php --version
```

**Composer**

```
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
php -r "unlink('composer-setup.php');"
sudo mv composer.phar /usr/local/bin/composer
```

Verify:

```
composer --version
```

---

Installing show-dependencies
----------------------------

[](#installing-show-dependencies)

Once PHP and Composer are ready, install this tool globally with:

```
composer global require franciscoernestoteixeira/show-dependencies
```

This places the `show-dependencies` binary into Composer's global `bin` directory.
You need to add that directory to your `PATH` so the command is available everywhere.

---

Adding the Composer global bin to PATH
--------------------------------------

[](#adding-the-composer-global-bin-to-path)

### 🪟 Windows

[](#-windows-1)

Composer's global bin directory on Windows is typically:

```
C:\Users\\AppData\Roaming\Composer\vendor\bin

```

To find the exact path on your machine:

```
composer global config bin-dir --absolute

```

Then add that path to your system `PATH` (same steps as adding `C:\php` above).

After adding it, open a **new** terminal and verify:

```
show-dependencies

```

> **Tip:** In PowerShell you can add it temporarily for the current session:
>
> ```
> $env:PATH += ";" + (composer global config bin-dir --absolute)
> ```

---

### 🍎 macOS

[](#-macos-1)

Find the directory:

```
composer global config bin-dir --absolute
```

It is usually `~/.composer/vendor/bin` or `~/.config/composer/vendor/bin`.

Add it permanently by appending to your shell profile. For **zsh** (default on macOS):

```
echo 'export PATH="$PATH:$(composer global config bin-dir --absolute 2>/dev/null)"' >> ~/.zshrc
source ~/.zshrc
```

For **bash**:

```
echo 'export PATH="$PATH:$(composer global config bin-dir --absolute 2>/dev/null)"' >> ~/.bash_profile
source ~/.bash_profile
```

Verify:

```
show-dependencies
```

---

### 🐧 Linux

[](#-linux)

Find the directory:

```
composer global config bin-dir --absolute
```

It is usually `~/.composer/vendor/bin` or `~/.config/composer/vendor/bin`.

Add it permanently to your shell profile:

```
echo 'export PATH="$PATH:$(composer global config bin-dir --absolute 2>/dev/null)"' >> ~/.bashrc
source ~/.bashrc
```

Verify:

```
show-dependencies
```

---

Usage
-----

[](#usage)

Navigate to the root of any PHP/Composer project — the folder that contains your `composer.json` — and run:

```
# Linux / macOS
show-dependencies

# Windows (Command Prompt or PowerShell)
show-dependencies
```

The tool will automatically look for `composer.lock` first, then fall back to scanning `vendor/`.

> You do **not** need to run it from inside the `vendor/` directory. Always run it from the **project root**.

---

Example
-------

[](#example)

Suppose your `composer.json` declares:

```
{
  "require": {
    "php": "^8.2",
    "ext-bcmath": "*",
    "ext-gd": "*",
    "laravel/framework": "^11.0",
    "guzzlehttp/guzzle": "^7.0"
  },
  "require-dev": {
    "phpunit/phpunit": "^10.0"
  }
}
```

And your project actually has installed:

- `laravel/framework 11.28.1`
- `guzzlehttp/guzzle 7.9.2`
- `phpunit/phpunit 10.5.36`

Running `show-dependencies` from the project root produces:

```
// Source (resolved packages): composer.lock

name                  version
--------------------  --------------------
php                   ^8.2  (declared)
ext-bcmath            *  (declared)
ext-gd                *  (declared)
guzzlehttp/guzzle     7.9.2
laravel/framework     11.28.1
phpunit/phpunit       10.5.36

// --- Paste into your composer.json ---
{
    "require": {
        "php": "^8.2",
        "ext-bcmath": "*",
        "ext-gd": "*",
        "guzzlehttp/guzzle": "7.9.2",
        "laravel/framework": "11.28.1"
    },
    "require-dev": {
        "phpunit/phpunit": "10.5.36"
    }
}

```

Platform requirements (`php`, `ext-*`, `lib-*`, `hhvm`) appear first in the table marked as `(declared)` and are carried through verbatim to the JSON excerpt — their original constraint is the correct value to preserve.

---

How it works
------------

[](#how-it-works)

1. Reads `composer.json` in the current directory for declared `require` / `require-dev` package names.
2. **Separates platform constraints** (`php`, `ext-*`, `lib-*`, `hhvm`) from real packages. Platform entries are kept verbatim — their original declared constraint is the correct value to preserve, since they have no `vendor/` entry to resolve against.
3. If `composer.lock` exists, reads exact versions from it for all non-platform packages — the most reliable source.
4. Supplements with a `vendor/` scan for any package the lock did not cover, or when no lock file exists at all.
5. When the same package appears at multiple depths in `vendor/`, the shallowest (closest to root) copy wins.
6. Strips a leading `v` from version strings (e.g. `v2.3.0` → `2.3.0`).
7. Prints the table: platform entries first (in their original declared order, marked `(declared)`), then resolved packages sorted alphabetically.
8. Prints the JSON excerpt in the same order, ready to paste back into `composer.json`.

---

Features
--------

[](#features)

- Lists **only declared dependencies** (`require` and `require-dev`)
- **Prefers `composer.lock`** for precision; falls back to `vendor/` gracefully
- **Preserves platform constraints** (`php`, `ext-*`, `lib-*`, `hhvm`) verbatim with their original declared value — they are not resolved or dropped
- Strips leading `v` prefix from version strings
- Outputs a **sorted table**
- Prints a **JSON excerpt** ready to paste into `composer.json`
- Reports packages declared but **not found**
- **Zero dependencies** — pure PHP, no external packages required
- **Works on Windows, macOS, and Linux**
- **Compatible with PHP 5.6 through 8.x**

---

Troubleshooting
---------------

[](#troubleshooting)

**`show-dependencies: command not found`**
The Composer global bin directory is not on your `PATH`. Follow the [Adding the Composer global bin to PATH](#adding-the-composer-global-bin-to-path) section above for your operating system.

**`composer.json not found in the current directory`**
You are not in the project root. Use `cd` to navigate to the folder that contains your `composer.json` before running the tool.

**Some packages show as "not found"**
The package is declared in `composer.json` but is not present in `composer.lock` or `vendor/`. Run `composer install` first to install all dependencies, then re-run `show-dependencies`.

**Version shows as a range or `*` instead of a real number**
This can happen if a package's own `composer.json` inside `vendor/` does not declare a `version` field (some development checkouts omit it). Use `composer.lock` — it always contains the resolved version — by running `composer install` before using this tool.

---

Running locally before publishing
---------------------------------

[](#running-locally-before-publishing)

You do not need to publish to Packagist to test the tool. There are two approaches, from simplest to most complete.

---

### Method 1 — Call PHP directly (quickest)

[](#method-1--call-php-directly-quickest)

This runs the script immediately without any installation step. Use this to verify the output is correct during development.

**1. Clone or download the `show-dependencies` repository to your machine.**

Let's say you saved it to:

OSExample pathLinux / macOS`/home/you/projects/show-dependencies`Windows`C:\projects\show-dependencies`**2. Open a terminal and navigate to the project you want to inspect** (not the `show-dependencies` folder — a real project that has its own `composer.json`):

```
# Linux / macOS
cd /home/you/projects/my-laravel-app

# Windows
cd C:\projects\my-laravel-app
```

**3. Run the script by calling PHP with the full path to the binary:**

```
# Linux / macOS
php /home/you/projects/show-dependencies/bin/show-dependencies

# Windows (Command Prompt)
php C:\projects\show-dependencies\bin\show-dependencies

# Windows (PowerShell)
php C:\projects\show-dependencies\bin\show-dependencies
```

You should see the table and JSON output immediately.
No `composer install`, no PATH changes, no installation required.

---

### Method 2 — Install globally via a local path (full end-to-end test)

[](#method-2--install-globally-via-a-local-path-full-end-to-end-test)

This is the closest simulation to how end users will install it from Packagist. Composer loads the package directly from your local folder instead of downloading it from the internet.

**1. Tell Composer's global config to look for packages in your local folder.**

```
composer global config repositories.show-dependencies \
  '{"type":"path","url":"/home/you/projects/show-dependencies","options":{"symlink":true}}'
```

On Windows (Command Prompt), replace single quotes with double quotes and escape the inner ones:

```
composer global config repositories.show-dependencies "{\"type\":\"path\",\"url\":\"C:\\projects\\show-dependencies\",\"options\":{\"symlink\":true}}"

```

The `"symlink": true` option means Composer links to your local folder instead of copying it, so any edits you make to the script are reflected immediately without reinstalling.

**2. Install it globally as usual:**

```
composer global require franciscoernestoteixeira/show-dependencies:@dev
```

The `@dev` flag is required when installing from a local path that has no version tag yet.

**3. Make sure the global bin directory is on your `PATH`** (see the [Adding the Composer global bin to PATH](#adding-the-composer-global-bin-to-path) section above).

**4. Test it from any project:**

```
cd /home/you/projects/my-laravel-app
show-dependencies
```

**5. When you are done testing, remove the local repository entry:**

```
composer global config --unset repositories.show-dependencies
```

And to remove the installed tool:

```
composer global remove franciscoernestoteixeira/show-dependencies
```

---

### Which method should I use?

[](#which-method-should-i-use)

SituationRecommended methodQuick smoke test / first runMethod 1 — direct PHP callTesting that the Composer binary registration worksMethod 2 — path repositoryTesting PATH setup and the `show-dependencies` command nameMethod 2 — path repositoryIterating on the script codeMethod 1 — no reinstall needed---

How to publish on Packagist
---------------------------

[](#how-to-publish-on-packagist)

1. Push the project to a **public** repository on GitHub, GitLab, or Bitbucket.
2. Go to , log in (or create a free account).
3. Click **Submit**, paste in your repository URL, and click **Check**.
    Packagist will auto-detect `composer.json` and register the package.
4. Set up a **webhook** so Packagist refreshes automatically on every push:

    - GitHub repo → **Settings → Webhooks → Add webhook**
    - Payload URL: `https://packagist.org/api/github?username=YOUR_PACKAGIST_USERNAME`
    - Content type: `application/json`
    - Secret: your Packagist API token (from your Packagist profile page)
    - Events: **Just the push event**
5. Tag your first stable release:

    ```
    git tag 1.0.0
    git push origin 1.0.0
    ```

    Packagist picks up the tag and makes `1.0.0` available as a stable version within a few minutes.

---

License
-------

[](#license)

MIT © [Francisco Ernesto Teixeira](https://github.com/franciscoernestoteixeira)

###  Health Score

30

—

LowBetter than 62% of packages

Maintenance79

Regular maintenance activity

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity29

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

111d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/1563399?v=4)[Francisco Ernesto Teixeira](/maintainers/franciscoernestoteixeira)[@franciscoernestoteixeira](https://github.com/franciscoernestoteixeira)

---

Top Contributors

[![franciscoernestoteixeira](https://avatars.githubusercontent.com/u/1563399?v=4)](https://github.com/franciscoernestoteixeira "franciscoernestoteixeira (2 commits)")

---

Tags

composercliversionsdependencieslockpackagist

### Embed Badge

![Health badge](/badges/franciscoernestoteixeira-show-dependencies/health.svg)

```
[![Health](https://phpackages.com/badges/franciscoernestoteixeira-show-dependencies/health.svg)](https://phpackages.com/packages/franciscoernestoteixeira-show-dependencies)
```

###  Alternatives

[nunomaduro/patrol

An elegant command-line tool that keeps your PHP Project's dependencies in check

275130.3k3](/packages/nunomaduro-patrol)[mwguerra/interactive-upgrader

A CLI tool that handles both Composer and npm dependencies for Laravel projects.

2115.1k](/packages/mwguerra-interactive-upgrader)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)