PHP Composer Cheat Sheet
Explains Composer CLI commands, composer.json structure, semantic version constraints, and PSR-4 autoloading for PHP dependency management.
1 PageBeginnerApr 15, 2026
Composer CLI
Common commands for managing PHP dependencies.
bash
composer init # Interactively create composer.jsoncomposer require monolog/monolog # Add a dependency and install itcomposer require --dev phpunit/phpunit # Add a dev-only dependencycomposer install # Install exact versions from composer.lockcomposer update # Update deps within version constraintscomposer dump-autoload # Regenerate the autoloadercomposer show # List installed packages
composer.json
Core structure of a Composer manifest file.
json
{ "name": "acme/myapp", "require": { "php": "^8.2", "guzzlehttp/guzzle": "^7.8" }, "require-dev": { "phpunit/phpunit": "^10.0" }, "autoload": { "psr-4": { "App\\": "src/" } }}
Composer Concepts
Version constraints and autoloading fundamentals.
- ^7.8 (caret)- Allows updates that don't change the leftmost non-zero digit, e.g. >=7.8.0 <8.0.0
- ~7.8.0 (tilde)- Allows patch-level updates only when three components are given, e.g. >=7.8.0 <7.9.0
- composer.lock- Pins the exact resolved versions; commit it for applications to guarantee reproducible installs
- require vs require-dev- require-dev packages (tests, linters) are excluded when installing with --no-dev in production
- PSR-4 autoloading- Maps namespace prefixes to directories so classes load automatically without manual require statements
- vendor/ directory- Where Composer installs packages and generates the vendor/autoload.php bootstrap file
Using the Autoloader
Bootstrapping PSR-4 classes and file-based helpers.
php
// index.phprequire __DIR__ . '/vendor/autoload.php';use App\Models\Post;$post = new Post();// composer.json can also autoload plain files:// "autoload": {// "psr-4": { "App\\": "src/" },// "files": ["src/helpers.php"]// }
Composer Scripts
Hooking custom commands into the install/update lifecycle.
json
{ "scripts": { "post-install-cmd": [ "@php artisan key:generate --ansi" ], "post-update-cmd": [ "Illuminate\\Foundation\\ComposerScripts::postUpdate" ], "test": "phpunit", "lint": "phpcs --standard=PSR12 src/" }}
Running & Chaining Scripts
Invoking custom scripts and composing them from other scripts.
bash
composer run-script test # Run the 'test' script explicitlycomposer test # Shorthand for any script namecomposer lint && composer test # Chain via shell# In composer.json, one script can call another with the @ prefix# "scripts": { "ci": ["@lint", "@test"] }
Custom Repositories
Pulling packages from a local path, a private VCS repo, or declaring package relationships.
json
{ "repositories": [ { "type": "path", "url": "../shared/logging-lib" }, { "type": "vcs", "url": "https://github.com/acme/private-pkg.git" } ], "require": { "acme/logging-lib": "*", "acme/private-pkg": "dev-main" }, "conflict": { "acme/legacy-pkg": "*" }, "replace": { "acme/deprecated-name": "self.version" }}
Diagnostics & Auditing
Commands for understanding why a package is installed and checking for known vulnerabilities.
bash
composer why guzzlehttp/guzzle # Show what requires this packagecomposer why-not laravel/framework 11 # Explain why an upgrade is blockedcomposer validate --strict # Lint composer.json for schema issuescomposer audit # Scan installed packages for known CVEscomposer diagnose # Check environment/config health
Advanced composer.json Settings
Config keys that shape resolution and autoloader performance beyond the basics.
- minimum-stability- Lowest stability (dev, alpha, beta, RC, stable) Composer will accept when no operator pins a version
- prefer-stable- When true, prefers stable releases over unstable ones that satisfy the same constraint
- allow-plugins- Explicit allow-list of Composer plugins permitted to execute code during install (security gate since Composer 2.2)
- optimize-autoloader- Generates a classmap instead of PSR-4 lookups at runtime; use --optimize-autoloader in production installs
- classmap autoload- Scans listed directories/files for classes regardless of namespace, useful for legacy non-PSR-4 code
- files autoload- Always includes listed files (e.g. helpers.php) on every request, independent of class autoloading
- provide- Declares that this package satisfies a virtual dependency another package requires, without being it
Pro Tip
Never hand-edit composer.lock without running composer install afterward to verify the resolved set actually installs cleanly — a stale or manually edited lock file can silently drift from composer.json.
Was this cheat sheet helpful?
Explore Topics
#PHPComposer#PHPComposerCheatSheet#Programming#Beginner#ComposerCLI#ComposerJson#ComposerConcepts#UsingTheAutoloader#CommandLine#CheatSheet#SkillVeris
