PHP Composer
Composer is PHP's dependency manager. It installs libraries from Packagist, autoloads your code, and pins versions in a lock file so every machine builds the same.
Install
Get it from getcomposer.org. After install, composer -V should print a version.
Start a project
SHELL
composer init # interactive — creates composer.json composer require monolog/monolog # add a library composer require --dev phpunit/phpunit # dev dependency only
composer.json basics
composer.json
{
"name": "vendor/app",
"require": {
"php": "^8.2",
"monolog/monolog": "^3.5"
},
"require-dev": {
"phpunit/phpunit": "^11.0"
},
"autoload": {
"psr-4": {
"App\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
}
}
Daily commands
| Command | Does |
|---|---|
composer install | Install from lock file. Use in CI / production. |
composer update | Pull newer versions within ranges; rewrite lock. |
composer update vendor/lib | Update one package. |
composer remove vendor/lib | Uninstall. |
composer dump-autoload -o | Regenerate optimised autoloader. |
composer outdated | List packages with newer versions. |
composer audit | Check installed packages for known vulnerabilities. |
Autoload
Add this at your entry point and Composer wires up class autoloading:
PHP — public/index.php
require __DIR__ . '/../vendor/autoload.php'; use App\Billing\Invoice; $inv = new Invoice();
Version constraints
| Constraint | Allows |
|---|---|
^3.5 | 3.5 ≤ x < 4.0 (most common). |
~3.5 | 3.5 ≤ x < 3.6. |
3.5.* | 3.5.0 ≤ x < 3.6. |
>=3.5 | Anything 3.5 or newer (avoid). |
Tip: Commit
composer.lock for apps; don't commit it for libraries (let the consumer's lock win). Run composer install --no-dev --optimize-autoloader in production.Example
Example
<?php // composer require monolog/monolog // composer install // composer update require __DIR__ . '/vendor/autoload.php'; echo 'Composer is the standard PHP dependency manager.';Try it Yourself »
Exercise
Daily command to add a library.
composer
monolog/monolog
Seven letters.
Discussion
Loading…