dantleech/depgraph

Comprehensable Composer PHP dependency diagrams for your small business or enterprise.

1.0.2 2026-07-12 17:51 UTC

Requires

• php: ^8.4
• composer/composer: ^2.9
• php-standard-library/type: ^6.2
• psr/log: ^3.0
• symfony/console: ^8.1

Requires (Dev)

• carthage-software/mago: ^1.42
• phpunit/phpunit: ^13.2
• symfony/var-dumper: ^7.1

MIT

• Daniel Leech

Published on Packagist.org on 2026-07-12 17:51 UTC

README

Generates rich dependency diagrams for your composer-based PHP project.

Above you can see:

• Dotted lines indicate a dev dependency.
• Bold lines indicate a direct dependency.
• Package version constraints listed on the lines.
• Licence information
• Red nodes indicate a package with security issues.
• Orange nodes are abandonned.
• Yellow nodes are outdated.
  • @1.0.0 indicates the installed version.
  • =1.0.0 indicates the latest version.
• The distance from the root package is shown as +[0-n]

Installation

You could install it as follows:

git clone [e-mail]:dantleech/depgraph
cd depgraph
composer install
ln -s $(pwd)/bin/depgraph $HOME/.local/bin/depgraph

You could also include it as a project dependency if you want:

composer require --dev dantleech/depgraph

Features

• Limit to production or development packages (--no-dev --no-prod).
• Limit depth of graph (--max-depth=2)
• Highlight packages with CVEs (--audit)
• Highlight outdated packages (--outdated)

Usage

Warning

Depgraph generates Graphviz Dot files. You will need to install the Graphviz on your operating system to access the dot binary.

The depgraph script will output a Graphviz Dot file to stdout. You can pipe it directly to the dot binary to generate a diagram:

depgraph | dot -Tsvg -ograph.svg

Specify a composer file:

depgraph path/to/my/composer.json | dot -Tsvg -ograph.svg

Do the slower things and output to a PNG:

depgraph path/to/my/composer.json --audit --outdated | dot -Tpng -ograph.png

🩸 made with blood and tears by you 🫵