Show available TYPO3 updates with Composer

Composer-based TYPO3 installations have many advantages. One of them is that you can see at a glance which updates are available for the core and extensions. No need to check manually in the backend.

I am regularly asked in 1:1 sessions how this works. So here are the three most important commands and when to use them.

The basic command: composer outdated

The easiest way to display all available updates:

composer outdated

With DDEV you use the command like this:

ddev composer outdated

What you see: A list of all packages for which newer versions are available. This includes all dependencies, i.e. also packages that you have not installed directly but that are required by other extensions.

When it makes sense: If you want to get a complete overview of what can be updated in your project. However, the list is often very long and confusing.

Focused: composer outdated -D

The parameter -D stands for "direct dependencies" and only shows you the packages that you have defined yourself in your composer.json:

composer outdated -D

For DDEV:

ddev composer outdated -D

What you see: Only TYPO3 Core and extensions that you have installed directly. All sub-dependencies are hidden.

When it makes sense: This is the command you need most often in practice. You can clearly see what is really relevant for your project. Perfect for regular update checks.

Even leaner: composer outdated -Dm

The additional parameter m stands for "minor" and filters the list further:

composer outdated -Dm

For DDEV:

ddev composer outdated -Dm

What you see: Only minor and patch updates of your direct dependencies. Major updates are hidden.

When it makes sense: If you want to quickly check which updates you can install with relatively little risk. Minor and patch updates should be backwards compatible and not contain any breaking changes. This makes them good candidates for quick update cycles.

Which command do you use and when?

Here is my practical recommendation:

For the regular check (weekly/monthly):

ddev composer outdated -D

You can see all direct updates at a glance and can decide what has priority.

For quick security updates:

ddev composer outdated -Dm

Shows you the non-critical updates that you can carry out quickly.

For full analysis (before large projects):

ddev composer outdated

If you are planning a comprehensive update project and want to know what is really affected.

DDEV or not?

If you use DDEV, put ddev in front of every Composer command. Composer then runs in the container with the correct PHP version.

If you are not using DDEV, simply omit ddev. The commands work identically, provided that your local PHP version matches the requirements of your project.

Conclusion

Three commands, three different levels of detail. In most cases, composer outdated -D is your go-to command for a quick overview. Try out the variants and find out which workflow suits you best.