Run composer prohibits with the package and the version you want. Composer lists which installed packages block that version, so you know exactly which requirement to change. Its sibling, composer depends, answers the opposite question and shows which packages require a given package.
Two commands, two questions
The Composer documentation defines them in a pair. The depends command, also called why, tells you which other packages depend on a certain package. The prohibits command, also called why-not, tells you which packages are blocking a given package from being installed. You can specify a version constraint to check whether an upgrade can be performed in your project and, if not, why not.
When a security advisory names a fixed version and composer update refuses to reach it, prohibits turns a vague resolver error into a short list of culprits.
Steps
- Note the package and fixed version from the advisory.
- Ask who blocks it.
- Ask who requires it, with the tree option, to see the chain up to your root.
- Decide which package in the chain to upgrade.
- Update with the right flags (the next guide covers them).
- Run composer audit and your tests.
composer prohibits vendor/package 2.1.0
composer depends vendor/package --tree
The tree option prints a recursive tree of why the package is depended upon. The documentation notes that, as with installation, require-dev relationships are considered only for the root package.
Reading the output
The output lines read like "package X version Y requires package Z with a constraint". Your fix is almost always to upgrade X, since X is the package whose requirement excludes your target version.
| Output | Meaning | Action |
|---|---|---|
| A direct requirement of your root package | Your own composer.json caps it | Edit your constraint |
| A third party package at an old version | That package caps it | Upgrade that package |
| A platform requirement such as php | Your PHP version limits it | Plan a runtime upgrade |
| Nothing listed | No block from the installed set | Check the repository and stability settings |
The documentation also shows that you can check platform requirements, for example whether you can upgrade your server to a newer PHP, with the same command. That is useful when an advisory fix needs a newer language version than you run.
When the blocker has no newer release
Sometimes the blocking package has no release that allows the fixed version. Your choices are then to ask the maintainer to widen the range, replace the blocking package, fork it, or accept the risk with a dated exception while you mitigate. Do not edit files in vendor. Those edits vanish on the next install.
Try it yourself
Click through it at your own pace, or open it full screen. See how a package can show up under more than one parent.
Where Safeguard fits
Safeguard scans dependencies, runs reachability analysis to show which findings your code can actually reach, and can open fix pull requests through autonomous remediation. That last feature is off by default and every category starts on Manual, so a person approves each change. You can try a free scan on a repository first.
Quick check
What is the difference between depends and prohibits?
Depends shows what requires a package. Prohibits shows what blocks a package or version from being installed.
Can prohibits check a PHP version upgrade?
Yes. The documentation shows it can check platform requirements such as the php version.
Sources
Last reviewed: 19 October 2026.
