PHPackages                             montag-webstudios/composer-update-guard - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. montag-webstudios/composer-update-guard

ActiveComposer-plugin[Security](/categories/security)

montag-webstudios/composer-update-guard
=======================================

Composer plugin that requires confirmation before a full 'composer update'. Protects teams from accidental full dependency updates and supply-chain attacks. Targeted updates (composer update vendor/package) stay allowed.

v1.0.0(1mo ago)02MITPHPPHP >=8.1

Since May 29Pushed 1mo agoCompare

[ Source](https://github.com/montag-webstudios/composer-update-guard)[ Packagist](https://packagist.org/packages/montag-webstudios/composer-update-guard)[ RSS](/packages/montag-webstudios-composer-update-guard/feed)WikiDiscussions main Synced 2w ago

READMEChangelogDependencies (2)Versions (2)Used By (0)

composer-update-guard
=====================

[](#composer-update-guard)

A global Composer plugin that requires confirmation before a **full** `composer update`. It prevents accidental full dependency updates across the team — a common entry point for supply-chain attacks.

- `composer update` → **guarded** (prompt; aborts with exit code 1 in `--no-interaction` mode)
- `composer update vendor/package` → **allowed** (targeted, reviewed update)
- `composer update --dry-run` → **allowed** (writes nothing)
- `composer update --lock` → **allowed** (lock hash only)
- `composer install`, `composer require …`, `composer remove …` → **untouched**

The plugin is installed **globally per development machine** and therefore automatically protects all of that user's projects.

Installation (once per team member)
-----------------------------------

[](#installation-once-per-team-member)

### Via Packagist

[](#via-packagist)

```
composer global config allow-plugins.montag-webstudios/composer-update-guard true
composer global require montag-webstudios/composer-update-guard
```

### Directly from the Git repository (without Packagist)

[](#directly-from-the-git-repository-without-packagist)

```
composer global config repositories.update-guard vcs https://github.com/montag-webstudios/composer-update-guard
composer global config allow-plugins.montag-webstudios/composer-update-guard true
composer global require montag-webstudios/composer-update-guard
```

> The `allow-plugins.montag-webstudios/composer-update-guard true` line is required as of Composer 2.2 so the plugin is allowed to load. If omitted, Composer will prompt interactively on first run.

Verify it is active
-------------------

[](#verify-it-is-active)

```
composer global show montag-webstudios/composer-update-guard
cd any/project && composer update --dry-run   # runs through
cd any/project && composer update             # prompts
```

Uninstall
---------

[](#uninstall)

```
composer global remove montag-webstudios/composer-update-guard
```

Publishing (maintainers)
------------------------

[](#publishing-maintainers)

1. Push this repository to `https://github.com/montag-webstudios/composer-update-guard`.
2. Submit it on  (Submit → repository URL). Add the GitHub webhook so Packagist auto-updates on push.
3. Tag a release (e.g. `git tag v1.0.0 && git push --tags`) so a stable version is installable.

Notes
-----

[](#notes)

- Acts only locally on the development machine. CI should use `composer install` (lock-based) instead of `composer update` anyway; an accidental `composer update --no-interaction` in a script is stopped by the guard with exit code 1.
- If you fork this under a different vendor, adjust `name`, the `autoload` namespace, `extra.class` in `composer.json`, and the namespace in `src/`.

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance89

Actively maintained with recent releases

Popularity2

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

58d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/11441968?v=4)[Phillip](/maintainers/phschmanau)[@phschmanau](https://github.com/phschmanau)

---

Top Contributors

[![phschmanau](https://avatars.githubusercontent.com/u/11441968?v=4)](https://github.com/phschmanau "phschmanau (3 commits)")

---

Tags

plugincomposersecurityupdateguardsupply-chain

### Embed Badge

![Health badge](/badges/montag-webstudios-composer-update-guard/health.svg)

```
[![Health](https://phpackages.com/badges/montag-webstudios-composer-update-guard/health.svg)](https://phpackages.com/packages/montag-webstudios-composer-update-guard)
```

###  Alternatives

[pyrech/composer-changelogs

Display changelogs after each composer update

5904.2M32](/packages/pyrech-composer-changelogs)[sllh/composer-versions-check

Checks if packages are up to date to last major versions after update

2362.4M16](/packages/sllh-composer-versions-check)[dgtlss/warden

A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email

9062.1k](/packages/dgtlss-warden)[bringyourownideas/silverstripe-maintenance

Toolset to help with the day by day maintenance work.

31224.9k5](/packages/bringyourownideas-silverstripe-maintenance)[plan2net/typo3-update-check

A Composer plugin that checks for TYPO3 updates and provides detailed information about breaking changes and security updates

207.2k](/packages/plan2net-typo3-update-check)[bringyourownideas/silverstripe-composer-security-checker

Provides information if your SilverStripe application uses dependencies with known vulnerabilities.

11104.0k2](/packages/bringyourownideas-silverstripe-composer-security-checker)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)