composer outdated without install - composer-php

Question

I'd like to fetch the composer.lock (& .json) from a project, and run some test to see if there is outdated packages in it.
the composer outdated seems to require me to install all packages first,
but that seams a bit overkill, as all needed information should be in the composer.lock-file.
Is there information avaible after an install, thats not avaible from the lock-file?
Is it posible to find outdated packages without running the composer install?
Update 1
I take "foolz/sphinxql-query-builder" as an exemple from one project.
In composer.json there is a
require['foolz/sphinxql-query-builder'] = '^1.0'.
In composer.lock there is a
packages[] = {name: foolz/sphinxql-query-builder, version: '1.0.2', ...}
In ~/.cache/composer/repo/https---packagist.org/p-provider-2018-04.json there is a providers['foolz/sphinxql-query-builder']->sha256
In ~/.cache/composer/repo/https---packagist.org/provider-foolz\$sphinxql-query-builder.json there is a
packages['foolz/sphinxql-query-builder']->$version
From that file i can run
array_keys((array) $json->packages->{'foolz/sphinxql-query-builder'})
to get a list of availible versions.
So how do i fetch the latest 'provider-foolz\$sphinxql-query-builder.json' file?

Answer 1

Composer.lock defines the exact versions of your packages, so only with this file you are not able to define if it is possible to upgrade the package to a new tag version
For example,
In composer.json you have this version of package
"laravelium/sitemap": "^3.0",
In composer lock there exists this information
{
"name": "laravelium/sitemap",
"version": "v3.0.1",
"source": {
"type": "git",
"url": "https://gitlab.com/Laravelium/Sitemap.git",
"reference": "b287ec4a6b47dcd63fd121199c05e059c479bc6f"
},
"dist": {
"type": "zip",
"url": "https://gitlab.com/api/v4/projects/Laravelium%2FSitemap/repository/archive.zip?sha=b287ec4a6b47dcd63fd121199c05e059c479bc6f",
"reference": "b287ec4a6b47dcd63fd121199c05e059c479bc6f",
"shasum": ""
},
"require": {
"illuminate/support": "5.7.*",
"php": ">=7.1.3"
},
"require-dev": {
"orchestra/testbench": "3.7.*",
"phpunit/phpunit": "~7.0"
},
"type": "library",
"extra": {
"laravel": {
"providers": [
"Laravelium\\Sitemap\\SitemapServiceProvider"
]
}
},
"autoload": {
"psr-0": {
"Laravelium\\Sitemap": "src/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Roumen Damianoff",
"email": "roumen#damianoff.com",
"homepage": "https://damianoff.com",
"role": "Developer"
}
],
"description": "Laravelium Sitemap package for Laravel.",
"homepage": "https://laravelium.com",
"keywords": [
"Sitemap",
"generator",
"google-news",
"html",
"laravel",
"laravelium",
"php",
"xml"
],
"time": "2018-09-04T19:08:44+00:00"
},
Note, that you will install version v3.{\d+} (>=3 && <4) if it exists, and new tag version may have incompatible change
composer show -l returns the list of packages. Coloured red packages can be updated, and colored green are on the latest version.
Nevertheless, you steel need to proceed with composer install, because only this way you can understand the exact versions of installed packages