Finding Out What Changed in a Lockfile
Retrospective web development exercise for the 2024 archive.
Install the dependencies in a sample PHP project and commit its Composer lockfile. Update one package on a test branch, then compare both the manifest and the lockfile. A one-line request to update a package can bring related dependencies along with it.
Look for versions that changed indirectly and test the parts of the site that use those packages. Try a clean install from the updated lockfile. That checks the setup another machine will get instead of relying on whatever is already in your vendor directory.