PHP Composer Dependency Manager


Composer is PHP's most commonly used dependency manager. It's analogous to npm in Node, pip for Python, or NuGet for .NET.


  • php path/to/composer.phar [command] [options] [arguments]


licenseDefines the type of license you want to use in the Project.
authorsDefines the authors of the project, as well as the author details.
supportDefines the support emails, irc channel, and various links.
requireDefines the actual dependencies as well as the package versions.
require-devDefines the packages necessary for developing the project.
suggestDefines the package suggestions, i.e. packages which can help if installed.
autoloadDefines the autoloading policies of the project.
autoload-devDefines the autoloading policies for developing the project.


Autoloading will only work for libraries that specify autoload information. Most libraries do and will adhere to a standard such as PSR-0 or PSR-4.

Helpful Links

Few Suggestions

  1. Disable xdebug when running Composer.
  2. Do not run Composer as root. Packages are not to be trusted.

What is Composer?

Composer is a dependency/package manager for PHP. It can be used to install, keep track of, and update your project dependencies. Composer also takes care of autoloading the dependencies that your application relies on, letting you easily use the dependency inside your project without worrying about including them at the top of any given file.

Dependencies for your project are listed within a composer.json file which is typically located in your project root. This file holds information about the required versions of packages for production and also development.

A full outline of the composer.json schema can be found on the Composer Website.

This file can be edited manually using any text-editor or automatically through the command line via commands such as composer require <package> or composer require-dev <package>.

To start using composer in your project, you will need to create the composer.json file. You can either create it manually or simply run composer init. After you run composer init in your terminal, it will ask you for some basic information about your project: Package name (vendor/package - e.g. laravel/laravel), Description - optional, Author and some other information like Minimum Stability, License and Required Packages.

The require key in your composer.json file specifies Composer which packages your project depends on. require takes an object that maps package names (e.g. monolog/monolog) to version constraints (e.g. 1.0.*).

    "require": {
        "composer/composer": "1.2.*"

To install the defined dependencies, you will need to run the composer install command and it will then find the defined packages that matches the supplied version constraint and download it into the vendor directory. It's a convention to put third party code into a directory named vendor.

You will notice the install command also created a composer.lock file.

A composer.lock file is automatically generated by Composer. This file is used to track the currently installed versions and state of your dependencies. Running composer install will install packages to exactly the state stored in the lock file.

Autoloading with Composer

While composer provides a system to manage dependencies for PHP projects (e.g. from Packagist), it can also notably serve as an autoloader, specifying where to look for specific namespaces or include generic function files.

It starts with the composer.json file:

    // ...
    "autoload": {
        "psr-4": {
            "MyVendorName\\MyProject": "src/"
        "files": [
    "autoload-dev": {
        "psr-4": {
            "MyVendorName\\MyProject\\Tests": "tests/"

This configuration code ensures that all classes in the namespace MyVendorName\MyProject are mapped to the src directory and all classes in MyVendorName\MyProject\Tests to the tests directory (relative to your root directory). It will also automatically include the file functions.php.

After putting this in your composer.json file, run composer update in a terminal to have composer update the dependencies, the lock file and generate the autoload.php file. When deploying to a production environment you would use composer install --no-dev. The autoload.php file can be found in the vendor directory which should be generated in the directory where composer.json resides.

You should require this file early at a setup point in the lifecycle of your application using a line similar to that below.

require_once __DIR__ . '/vendor/autoload.php';

Once included, the autoload.php file takes care of loading all the dependencies that you provided in your composer.json file.

Some examples of the class path to directory mapping:

  • MyVendorName\MyProject\Shapes\Squaresrc/Shapes/Square.php.
  • MyVendorName\MyProject\Tests\Shapes\Squaretests/Shapes/Square.php.

Benefits of Using Composer

Composer tracks which versions of packages you have installed in a file called composer.lock, which is intended to be committed to version control, so that when the project is cloned in the future, simply running composer install will download and install all the project's dependencies.

Composer deals with PHP dependencies on a per-project basis. This makes it easy to have several projects on one machine that depend on separate versions of one PHP package.

Composer tracks which dependencies are only intended for dev environments only

composer require --dev phpunit/phpunit

Composer provides an autoloader, making it extremely easy to get started with any package. For instance, after installing Goutte with composer require fabpot/goutte, you can immediately start to use Goutte in a new project:


require __DIR__ . '/vendor/autoload.php';

$client = new Goutte\Client();

// Start using Goutte

Composer allows you to easily update a project to the latest version that is allowed by your composer.json. EG. composer update fabpot/goutte, or to update each of your project's dependencies: composer update.

Difference between 'composer install' and 'composer update'

composer update

composer update will update our dependencies as they are specified in composer.json.

For example, if our project uses this configuration:

"require": {
    "laravelcollective/html": "2.0.*"

Supposing we have actually installed the 2.0.1 version of the package, running composer update will cause an upgrade of this package (for example to 2.0.2, if it has already been released).

In detail composer update will:

  • Read composer.json
  • Remove installed packages that are no more required in composer.json
  • Check the availability of the latest versions of our required packages
  • Install the latest versions of our packages
  • Update composer.lock to store the installed packages version

composer install

composer install will install all of the dependencies as specified in the composer.lock file at the version specified (locked), without updating anything.

In detail:

  • Read composer.lock file
  • Install the packages specified in the composer.lock file

When to install and when to update

  • composer update is mostly used in the 'development' phase, to upgrade our project packages.

  • composer install is primarily used in the 'deploying phase' to install our application on a production server or on a testing environment, using the same dependencies stored in the composer.lock file created by composer update.

Composer Available Commands

aboutShort information about Composer
archiveCreate an archive of this composer package
browseOpens the package's repository URL or homepage in your browser.
clear-cacheClears composer's internal package cache.
clearcacheClears composer's internal package cache.
configSet config options
create-projectCreate new project from a package into given directory.
dependsShows which packages cause the given package to be installed
diagnoseDiagnoses the system to identify common errors.
dump-autoloadDumps the autoloader
dumpautoloadDumps the autoloader
execExecute a vendored binary/script
globalAllows running commands in the global composer dir ($COMPOSER_HOME).
helpDisplays help for a command
homeOpens the package's repository URL or homepage in your browser.
infoShow information about packages
initCreates a basic composer.json file in current directory.
installInstalls the project dependencies from the composer.lock file if present, or falls back on the composer.json.
licensesShow information about licenses of dependencies
listLists commands
outdatedShows a list of installed packages that have updates available, including their latest version.
prohibitsShows which packages prevent the given package from being installed
removeRemoves a package from the require or require-dev
requireAdds required packages to your composer.json and installs them
run-scriptRun the scripts defined in composer.json.
searchSearch for packages
self-updateUpdates composer.phar to the latest version.
selfupdateUpdates composer.phar to the latest version.
showShow information about packages
statusShow a list of locally modified packages
suggestsShow package suggestions
updateUpdates your dependencies to the latest version according to composer.json, and updates the composer.lock file.
validateValidates a composer.json and composer.lock
whyShows which packages cause the given package to be installed
why-notShows which packages prevent the given package from being installed


You may install Composer locally, as part of your project, or globally as a system wide executable.


To install, run these commands in your terminal.

php -r "copy('', 'composer-setup.php');"
# to check the validity of the downloaded installer, check here against the SHA-384:
php composer-setup.php
php -r "unlink('composer-setup.php');"

This will download composer.phar (a PHP Archive file) to the current directory. Now you can run php composer.phar to use Composer, e.g.

php composer.phar install


To use Composer globally, place the composer.phar file to a directory that is part of your PATH

mv composer.phar /usr/local/bin/composer

Now you can use composer anywhere instead of php composer.phar, e.g.

composer install