A free Claude Code skill that turns composer outdated into a clear plan, and finds replacements for dead packages.

The problem

You run composer outdated. You get a wall of red and yellow.

Now what?

Some updates are safe. Some will break your app. One package is abandoned, and Composer just says “No replacement was suggested.” A security advisory is open, but you are not sure which version actually fixes it.

Tools like composer outdated, composer audit, and Dependabot are great at one thing: telling you the facts. They do not tell you what to do about them. That part is still on you.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

What this skill does

composer-dependency-triage is a small Claude Code skill. You ask it in plain English, and it reads your real project, then hands you a plan.

It does three things the standard tools do not:

1. Finds replacements for abandoned packages. When a package is dead and Composer offers nothing, the skill suggests a maintained, community-standard successor.

2. Thinks in Laravel terms. It knows which packages are first-party, which majors are tied to your framework version, and what a bump really means in a Laravel app.

3. Ties findings to your upgrade path. If a fix is really blocked on a Laravel or PHP upgrade, it says so instead of pushing a risky bump.

The output is a simple, sorted plan: Do now, Do carefully, Defer.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

How it works

You open Claude Code in your Laravel project and type something like: “audit my composer dependencies”.

The skill runs read-only commands (composer outdated, composer audit, composer why, composer show), reads your composer.json and lock file, and writes a report.

Every line traces back to real tool output. It never invents a version number or a CVE. If it cannot run a tool, it tells you, instead of guessing.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

It never touches your files

This is the important part. The skill is advise-only.

It reads. It recommends. It gives you the exact commands to run yourself. It never edits your composer.json, your lock file, or your code. You stay in control of every change.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Try it

Install one folder, no marketplace needed. Run this in your project:

npx degit ArtemProshkovskiy/laravel-maintenance-skills/skills/composer-dependency-triage .claude/skills/composer-dependency-triage

Then ask: “what should I update?” or “are any of my packages abandoned?”

That is it. No config.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Why it matters

Dependency rot is quiet. It builds up until an upgrade becomes scary. A clear, honest triage turns that fear into a short list you can act on this week.

Detection is solved. Judgment is the missing piece. This skill is the judgment layer.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Get it on GitHub

The skill is free and open source. Code, install steps, and the other skills in the library are here:

https://github.com/ArtemProshkovskiy/laravel-maintenance-skills

If this helped you, a star on GitHub means a lot and helps other Laravel devs find it. Thank you.

Built by Artem Proshkovskyi. Free and open source (MIT).