So if you happen to insert invalid version string when requiring package, it will still write it into composer.json and nothing works after that. So for example; composer require phpunit/phpunit:"8.3.3 as ^8.3"

My composer.json:

{
    "require": {
        "phpunit/phpunit": "8.3.3 as ^8.3"
    }
}

Output of composer diagnose:

$ composer diagnose
        

There are about ~240 URLs and licenses listed at https://directory.fsf.org/wiki?title=Category:License
We should:

1. ensure that we can detect all of them
2. ensure that we can detect their URL
   We should also add as an "other_urls" ech URL to the corresponding license YAML

fsf-license-urls.txt

Some controllers rely solely on Pundit and others on custom legacy code like require_admin to authorize various actions throughout the application.

We want to rely completely on Pundit to use a widely adopted authorization s

Some packages may bundle dependencies. We could report outdatedness for these the following way: for outdated packages with single download, propagate outdated status onto the download URL. Then we could show this download specially for other packages, or even make it affect the status.