So if you happen to insert invalid version string when requiring package, it will still write it into composer.json and nothing works after that. So for example; composer require phpunit/phpunit:"8.3.3 as ^8.3"

My composer.json:

{
    "require": {
        "phpunit/phpunit": "8.3.3 as ^8.3"
    }
}

Output of composer diagnose:

$ composer diagnose
        

hendry@knuckles ~ $ bitcoin-cli
terminate called after throwing an instance of 'std::runtime_error'
  what():  locale::facet::_S_create_c_locale name not valid
Aborted

Workaround: LANG=C bitcoin-cli

hendry@knuckles ~ $ xbps-query -S bitcoin
architecture: x86_64-musl
build-date: 2020-01-26 01:06 CST
conflicts:
        litecoin>=0
filename-sha256: d8c0ea89f1cc36aa3

There are about ~240 URLs and licenses listed at https://directory.fsf.org/wiki?title=Category:License
We should:

1. ensure that we can detect all of them
2. ensure that we can detect their URL
   We should also add as an "other_urls" ech URL to the corresponding license YAML

fsf-license-urls.txt

Some controllers rely solely on Pundit and others on custom legacy code like require_admin to authorize various actions throughout the application.

We want to rely completely on Pundit to use a widely adopted authorization s

Some packages may bundle dependencies. We could report outdatedness for these the following way: for outdated packages with single download, propagate outdated status onto the download URL. Then we could show this download specially for other packages, or even make it affect the status.