PHP TutorialCompile PHP ExtensionsContributing to the PHP CoreContributing to the PHP ManualCreate PDF files in PHPInstalling a PHP environment on WindowsPHP Alternative Syntax for Control StructuresPHP APCuPHP Array iterationPHP ArraysPHP Asynchronous programmingPHP Autoloading PrimerPHP BC Math (Binary Calculator)PHP Built in serverPHP CachePHP Classes and ObjectsPHP ClosurePHP Coding ConventionsPHP Command Line Interface (CLI)PHP CommentsPHP Common ErrorsPHP Compilation of Errors and WarningsPHP Composer Dependency ManagerPHP ConstantsPHP Control StructuresPHP CookiesPHP CryptographyPHP DateTime ClassPHP DebuggingPHP Dependency InjectionPHP Design PatternsPHP Docker deploymentPHP Exception Handling and Error ReportingPHP Executing Upon an ArrayPHP File handlingPHP Filters & Filter FunctionsPHP Functional ProgrammingPHP FunctionsPHP GeneratorsPHP Headers ManipulationPHP How to break down an URLPHP How to Detect Client IP AddressPHP HTTP AuthenticationPHP Image Processing with GDPHP ImagickPHP IMAPPHP Installing on Linux/Unix EnvironmentsPHP JSONPHP LocalizationPHP LoopsPHP Machine learningPHP Magic ConstantsPHP Magic MethodsPHP Manipulating an ArrayPHP mongo-phpPHP Multi Threading ExtensionPHP MultiprocessingPHP MySQLiPHP MySQLi affected rows returns 0 when it should return a positive integerPHP NamespacesPHP Object SerializationPHP OperatorsPHP Output BufferingPHP Outputting the Value of a VariablePHP Parsing HTMLPHP Password Hashing FunctionsPHP PDOPHP PerformancePHP PHPDocPHP Processing Multiple Arrays TogetherPHP PSRPHP Reading Request DataPHP RecipesPHP ReferencesPHP ReflectionPHP Regular Expressions (regexp/PCRE)PHP Secure Remeber MePHP SecurityPHP Sending EmailPHP SerializationPHP SessionsPHP SimpleXMLPHP SOAP ClientPHP SOAP ServerPHP SocketsPHP SPL data structuresPHP SQLite3PHP StreamsPHP String formattingPHP String Parsing

PHP Composer Dependency Manager

From WikiOD

Composer is PHP's most commonly used dependency manager. It's analogous to npm in Node, pip for Python, or NuGet for .NET.

Syntax[edit | edit source]

  • php path/to/composer.phar [command] [options] [arguments]

Parameters[edit | edit source]

Parameter Details
license Defines the type of license you want to use in the Project.
authors Defines the authors of the project, as well as the author details.
support Defines the support emails, irc channel, and various links.
require Defines the actual dependencies as well as the package versions.
require-dev Defines the packages necessary for developing the project.
suggest Defines the package suggestions, i.e. packages which can help if installed.
autoload Defines the autoloading policies of the project.
autoload-dev Defines the autoloading policies for developing the project.

Remarks[edit | edit source]

Autoloading will only work for libraries that specify autoload information. Most libraries do and will adhere to a standard such as PSR-0 or PSR-4.

Helpful Links[edit | edit source]

Few Suggestions[edit | edit source]

  1. Disable xdebug when running Composer.
  2. Do not run Composer as root. Packages are not to be trusted.

Autoloading with Composer[edit | edit source]

While composer provides a system to manage dependencies for PHP projects (e.g. from Packagist), it can also notably serve as an autoloader, specifying where to look for specific namespaces or include generic function files.

It starts with the composer.json file:

    // ...
    "autoload": {
        "psr-4": {
            "MyVendorName\\MyProject": "src/"
        "files": [
    "autoload-dev": {
        "psr-4": {
            "MyVendorName\\MyProject\\Tests": "tests/"

This configuration code ensures that all classes in the namespace MyVendorName\MyProject are mapped to the src directory and all classes in MyVendorName\MyProject\Tests to the tests directory (relative to your root directory). It will also automatically include the file functions.php.

After putting this in your composer.json file, run composer update in a terminal to have composer update the dependencies, the lock file and generate the autoload.php file. When deploying to a production environment you would use composer install --no-dev. The autoload.php file can be found in the vendor directory which should be generated in the directory where composer.json resides.

You should require this file early at a setup point in the lifecycle of your application using a line similar to that below.

require_once __DIR__ . '/vendor/autoload.php';

Once included, the autoload.php file takes care of loading all the dependencies that you provided in your composer.json file.

Some examples of the class path to directory mapping:

  • MyVendorName\MyProject\Shapes\Square ➔ src/Shapes/Square.php.
  • MyVendorName\MyProject\Tests\Shapes\Square ➔ tests/Shapes/Square.php.

What is Composer?[edit | edit source]

Composer is a dependency/package manager for PHP. It can be used to install, keep track of, and update your project dependencies. Composer also takes care of autoloading the dependencies that your application relies on, letting you easily use the dependency inside your project without worrying about including them at the top of any given file.

Dependencies for your project are listed within a composer.json file which is typically located in your project root. This file holds information about the required versions of packages for production and also development.

A full outline of the composer.json schema can be found on the Composer Website.

This file can be edited manually using any text-editor or automatically through the command line via commands such as composer require <package> or composer require-dev <package>.

To start using composer in your project, you will need to create the composer.json file. You can either create it manually or simply run composer init. After you run composer init in your terminal, it will ask you for some basic information about your project: Package name (vendor/package - e.g. laravel/laravel), Description - optional, Author and some other information like Minimum Stability, License and Required Packages.

The require key in your composer.json file specifies Composer which packages your project depends on. require takes an object that maps package names (e.g. monolog/monolog) to version constraints (e.g. 1.0.*).

    "require": {
        "composer/composer": "1.2.*"

To install the defined dependencies, you will need to run the composer install command and it will then find the defined packages that matches the supplied version constraint and download it into the vendor directory. It's a convention to put third party code into a directory named vendor.

You will notice the install command also created a composer.lock file.

A composer.lock file is automatically generated by Composer. This file is used to track the currently installed versions and state of your dependencies. Running composer install will install packages to exactly the state stored in the lock file.

Difference between 'composer install' and 'composer update'[edit | edit source]

composer update[edit | edit source]

composer update will update our dependencies as they are specified in composer.json.

For example, if our project uses this configuration:

"require": {
    "laravelcollective/html": "2.0.*"

Supposing we have actually installed the 2.0.1 version of the package, running composer update will cause an upgrade of this package (for example to 2.0.2, if it has already been released).

In detail composer update will:

  • Read composer.json
  • Remove installed packages that are no more required in composer.json
  • Check the availability of the latest versions of our required packages
  • Install the latest versions of our packages
  • Update composer.lock to store the installed packages version

composer install[edit | edit source]

composer install will install all of the dependencies as specified in the composer.lock file at the version specified (locked), without updating anything.

In detail:

  • Read composer.lock file
  • Install the packages specified in the composer.lock file

When to install and when to update[edit | edit source]

  • composer update is mostly used in the 'development' phase, to upgrade our project packages.
  • composer install is primarily used in the 'deploying phase' to install our application on a production server or on a testing environment, using the same dependencies stored in the composer.lock file created by composer update.

Composer Available Commands[edit | edit source]

Command Usage
about Short information about Composer
archive Create an archive of this composer package
browse Opens the package's repository URL or homepage in your browser.
clear-cache Clears composer's internal package cache.
clearcache Clears composer's internal package cache.
config Set config options
create-project Create new project from a package into given directory.
depends Shows which packages cause the given package to be installed
diagnose Diagnoses the system to identify common errors.
dump-autoload Dumps the autoloader
dumpautoload Dumps the autoloader
exec Execute a vendored binary/script
global Allows running commands in the global composer dir ($COMPOSER_HOME).
help Displays help for a command
home Opens the package's repository URL or homepage in your browser.
info Show information about packages
init Creates a basic composer.json file in current directory.
install Installs the project dependencies from the composer.lock file if present, or falls back on the composer.json.
licenses Show information about licenses of dependencies
list Lists commands
outdated Shows a list of installed packages that have updates available, including their latest version.
prohibits Shows which packages prevent the given package from being installed
remove Removes a package from the require or require-dev
require Adds required packages to your composer.json and installs them
run-script Run the scripts defined in composer.json.
search Search for packages
self-update Updates composer.phar to the latest version.
selfupdate Updates composer.phar to the latest version.
show Show information about packages
status Show a list of locally modified packages
suggests Show package suggestions
update Updates your dependencies to the latest version according to composer.json, and updates the composer.lock file.
validate Validates a composer.json and composer.lock
why Shows which packages cause the given package to be installed
why-not Shows which packages prevent the given package from being installed

Benefits of Using Composer[edit | edit source]

Composer tracks which versions of packages you have installed in a file called composer.lock, which is intended to be committed to version control, so that when the project is cloned in the future, simply running composer install will download and install all the project's dependencies.

Composer deals with PHP dependencies on a per-project basis. This makes it easy to have several projects on one machine that depend on separate versions of one PHP package.

Composer tracks which dependencies are only intended for dev environments only

composer require --dev phpunit/phpunit

Composer provides an autoloader, making it extremely easy to get started with any package. For instance, after installing Goutte with composer require fabpot/goutte, you can immediately start to use Goutte in a new project:


require __DIR__ . '/vendor/autoload.php';

$client = new Goutte\Client();

// Start using Goutte

Composer allows you to easily update a project to the latest version that is allowed by your composer.json. EG. composer update fabpot/goutte, or to update each of your project's dependencies: composer update.

Installation[edit | edit source]

You may install Composer locally, as part of your project, or globally as a system wide executable.

Locally[edit | edit source]

To install, run these commands in your terminal.

php -r "copy('', 'composer-setup.php');"
# to check the validity of the downloaded installer, check here against the SHA-384:
php composer-setup.php
php -r "unlink('composer-setup.php');"

This will download composer.phar (a PHP Archive file) to the current directory. Now you can run php composer.phar to use Composer, e.g.

php composer.phar install

Globally[edit | edit source]

To use Composer globally, place the composer.phar file to a directory that is part of your PATH

mv composer.phar /usr/local/bin/composer

Now you can use composer anywhere instead of php composer.phar, e.g.

composer install