A simple measure of software dependency freshness

2.3.0 2022-12-15 21:07 UTC


A simple measure of dependency freshness

Version CI Coverage

Maintainability Rating Reliability Rating Security Rating

Calculates the total number of years behind their respective newest versions for all dependencies listed in composer.json.


  • PHP v7.4 or later
  • Composer v2

Note that 2.3.0 is the last release that will support PHP 7.4 and 8.0; v3 (expected Q3 2023) will only support PHP 8.1+.

Ongoing commercial support for legacy versions of PHP is available for Corporate, Premier, and Title Sponsors.


Recommended: Composer

Run composer global require ecoapm/libyear and make sure your global composer directory is in your $PATH.

Alternatively, composer require --dev ecoapm/libyear will add libyear as a local dev dependency for your current directory's app.

Alternative: PHP Archive (PHAR) File

Download libyear.phar from the latest release, and put it in the current directory, or somewhere in your $PATH to be able to reference it from anywhere.

Windows Users

Note that PHP for Windows does not include CA certificates, so you'll need to install them if you haven't done so already:

  1. Download to somewhere permanent (PHP's extras directory is a great place)
  2. Add curl.cainfo = "[full path to]\cacert.pem" to your php.ini file


vendor/bin/libyear <path> [-q|--quiet] [-v|--verbose]

(or php path/to/libyear.phar <path> [-q|--quiet] [-v|--verbose] for the PHAR version)


  • path: required, directory containing composer.json and composer.lock files


  • -h, --help: show help text and exit without checking dependencies
  • -q, --quiet: quiet mode will only output libraries which are not up-to-date (that is, where "Libyears Behind" > 0)
  • -u, --update: update mode will write the latest version info to your composer.json file (note that you'll still need to run composer update to actually update your local dependencies)
  • -v, --verbose: verbose mode will output processing details like when a library isn't found in a repository


Please be sure to read and follow ecoAPM's Contribution Guidelines when submitting issues or pull requests.

When testing new features and bug fixes, you can run the script via ./libyear { path } [-q] before building the phar file.

To build the phar file for final manual testing, run php -dphar.readonly=0 build.php. You may wish to run composer install --no-dev first to speed up the build process by removing dev dependencies, but will need to reinstall them via composer install (specifically, phpunit and mockery for unit testing).