Data & Text
Constraint
Versions to test
Result
Matching runs entirely in your browser. Loading from Packagist sends only the package name to this site, which fetches its public release list.
Constraint cheat sheet
| Constraint | Means | Notes |
|---|---|---|
| ^1.2.3 | >=1.2.3 <2.0.0 | The default composer require gives you. Allows anything that shouldn't break backwards compatibility under semver. |
| ^0.3 | >=0.3.0 <0.4.0 | Below 1.0, the caret locks the minor version too, since 0.x releases are allowed to break things. |
| ^0.0.3 | >=0.0.3 <0.0.4 | And below 0.1, it effectively pins the exact patch. |
| ~1.2 | >=1.2.0 <2.0.0 | The tilde lets only the last number given float — here the minor. |
| ~1.2.3 | >=1.2.3 <1.3.0 | With three numbers, only the patch floats. ~ and ^ differ most here. |
| 1.2.* | >=1.2.0 <1.3.0 | Wildcard. Same as ~1.2.0. |
| 1.0 - 2.0 | >=1.0.0 <2.1.0 | Hyphen ranges are inclusive, and a partial upper bound is filled out with a wildcard — so all of 2.0.x is included. |
| >=1.0 <2.0 | both | A space or comma means AND. |
| ^1.0 || ^2.0 | either | || (or a single |) means OR. The usual way to support two major versions of a framework at once. |
| ^2.0@beta | >=2.0.0 <3.0.0 | A stability flag: lets this package install beta (or more stable) releases, whatever minimum-stability says. |
Why pre-releases show as matching
Composer's constraints themselves don't care about stability — internally ^1.2 becomes >= 1.2.0.0-dev < 2.0.0.0-dev, so 1.5.0-beta1 is inside the range. What keeps pre-releases out of a normal install is a separate filter: the project's minimum-stability (default stable), which can be loosened per package with an @beta-style flag, or by requiring an exact unstable version like 2.0.0-beta1. This tool shows both: a version can match the constraint but still be ruled out by stability, and those are marked separately.
What "would install" means here
It's the highest version that both matches and passes the stability filter — or with prefer-stable, the highest of the most stable matches. A real composer update also has to satisfy every other package's requirements and your PHP version and extensions, so it can end up lower. If it does, composer why-not vendor/package 12.19.3 tells you which requirement is holding it back.
Branches
dev-master, dev-main, and other dev- branches only ever match a constraint that names them exactly (or != another one). Numbered branches like 12.x-dev are different: Composer treats them as the version 12.9999999.9999999.9999999-dev, so they do match ranges such as ^12.0, subject to stability. Packagist loading only lists tagged releases, not branches.