Document that composer update --dry-run roave/security-advisories is equivalent to checking locked dependencies

[Ocramius]

Also worth investigating if composer require --dry-run --dev roave/security-advisories would work.

This work should be reflected in README.md

[azjezz]

Also worth investigating if composer require --dry-run --dev roave/security-advisories would work.

there's no dry-run option in the require command

[Ocramius]

@azjezz maybe something worth adding upstream?

[alcohol]

require is basically a shortcut for programatically updating your composer.json file with the new requirement (and some magic that determines a constraint if not given), and then running update. So passing the --dry-run from require on to the update command should be feasible I think. But you'd also have to reverse the change to the composer.json file afterwards, and that makes it more tricky. I think an RFC for this would probably be accepted though (submitting a PR would help a lot in that regard 👍).

[azjezz]

@Ocramius azjezz/composer@a85d64c :)

[alcohol]

@azjezz the only (minor) flaw with that is that you hide the output also in case of an error during the dry-run attempt.

[Ocramius]

Closing here, handled by @GeeH in #60

[azjezz]

@alcohol huh, will check later, thanks :)