Name the package: composer update vendor/package. Composer limits the update to that dependency. If the fix needs its dependencies to move too, add the with-dependencies option. To keep other changes to the minimum, add minimal-changes. Then review the composer.lock diff.
The options at a glance
| Option | Effect |
|---|---|
| (name only) | Update just the named package |
| with-dependencies, short form w | Also update the package's dependencies, except root requirements |
| with-all-dependencies, short form W | Also update dependencies that are root requirements |
| minimal-changes, short form m | Only absolutely necessary changes |
| dry-run | Show what would change without doing it |
These come from the Composer command line documentation. The basic usage page also says you can limit an update to named packages if you only want to install, upgrade or remove one dependency.
Steps for a security fix
- Find the fixed version from the advisory.
- Preview the change with a dry run.
- Run the real update for that package, using minimal-changes.
- Read the composer.lock diff. Only the package and what it needs should move.
- Run tests, then an advisory check on the lock file.
- Open a small pull request with a clear title.
composer update vendor/package --dry-run
composer update vendor/package --minimal-changes
composer update vendor/package --with-dependencies
composer audit --locked
Why small diffs matter
A fix that drags along thirty unrelated upgrades is hard to review and hard to roll back. It also mixes a security change with feature changes from other packages. Reviewers skim, and a skimmed diff is where a bad release slips in. A one package update gives a reviewer something they can actually read.
When it will not stay small
If the new version requires newer versions of other packages, Composer will refuse to keep them fixed unless you allow dependency updates. Run why-not to find out which package blocks the move, as in our guide to tracing vulnerable dependencies. Then decide whether to upgrade that blocker as well.
Try it yourself
Click through it at your own pace, or open it full screen. See how a single fixed version turns into a small, reviewable change.
Where Safeguard fits
Safeguard's SBOM and dependency scanning reads composer.lock and Gemfile.lock and flags known advisories. A free scan takes a few minutes.
Quick check
Does naming a package update its dependencies?
Not unless you ask. Use with-dependencies for non root dependencies, or with-all-dependencies to include root requirements too.
Should security fixes be batched with other updates?
Better not. A separate small change is easier to review, test and revert.
Sources
Last reviewed: 19 October 2026.
