—

Why it Matters

Outdated direct dependencies (the packages explicitly required in composer.json) often include security patches, bug fixes, and compatibility updates. If direct dependencies are not kept up-to-date, Magento stores may run vulnerable or unsupported code, increasing the attack surface and creating technical debt.

Ensuring direct dependencies are current makes it easier to adopt upstream fixes, maintain compatibility with PHP/Magento upgrades, and reduce the risk of using abandoned versions.

Verification Steps

Composer check

# List outdated direct dependencies
composer outdated --direct

# Expected: no critical packages listed as outdated

Audit in CI/CD

# Include in pipeline
composer outdated --direct --strict
# Fail build if direct deps not up-to-date

Remediation / Fix Guidance

Run composer outdated --direct weekly to identify outdated packages.
Upgrade direct dependencies to the latest stable versions:
```
composer require vendor/extension:^x.y.z
```
Test checkout, login, cron, and other critical flows after each upgrade.
Commit the updated composer.lock to ensure reproducible builds.
Document upgrade history in changelog or dependency tracker.

Examples

Fail Example

$ composer outdated --direct
vendor/module   1.2.0   1.4.3   Security patches available
# FAIL: Direct dependency outdated

Pass Example

$ composer outdated --direct
# (no output)
# PASS: All direct dependencies are up-to-date