Composer Update - Risky?

010101

Besides an extension breaking something is there risk to running composer update? I do it every now and then and I notice that many times Symfony files update. What if something that is part of core updates and the forum breaks? Or, would that be pretty rare? Maybe the Symfony folks don’t push breaking changes?

jordanjay29

010101 Are you simply running composer update bare? Without any other arguments?

luceos

Running update will install all packages based on the constraints provided in the composer.json. This isn't really harmful as running composer update should always be possible. Whether you make Flarum unstable depends on whether you toyed with the composer.json so that unstable dependencies are installed 😉

rob006

luceos You're making many assumptions. Like that people don't make mistakes and all packages are always 100% backward compatible (which is simply impossible). 😉

Basically every update brings a risk of breaking something - from simple and harmless bugs to white screens of death. It should be pretty rare in practice, but there is a good reason why running composer update on production is discouraged.

010101

Thanks all! I'll think twice before doing it again on a live production website. 😀 Unless I forget about this discussion. Which is possible. If I post and ask this same question again in 9 months you know I forgot.

brian85

010101 I think that the good practice is every time you wish to install an extension or do a composer update, make a snapshot on your virtual machine before! It's avoiding lot of stress!

jordanjay29

brian85 Even easier, back up your composer.json and composer.lock files. Those will allow you to reinstall the exact same setup (provided the packages still exist).

FBI

Note it, with thanks 👍️