Composer
By the Composer/PHP community
lock` file that pins exact versions for reproducible installs. It also provides autoloading configuration so PHP projects can load classes from installed dependencies automatically without writing manual `require` statements by hand…
Definition
Composer is the standard dependency manager for the PHP programming language, resolving and installing project libraries listed in a `composer.json` manifest and generating a `composer.lock` file that pins exact versions for reproducible installs. It also provides autoloading configuration so PHP projects can load classes from installed dependencies automatically without writing manual `require` statements by hand throughout every file in the codebase.
Overview
PHP historically lacked a single, widely adopted way to declare and install project dependencies; libraries were often downloaded manually or managed through framework-specific mechanisms, making it hard to share reusable code across projects and frameworks. Composer addressed this by defining a common manifest format, `composer.json`, and a central public repository, Packagist, where PHP package authors publish versioned libraries that any Composer-based project can declare as a dependency. Mechanically, when a project runs `composer install` or `composer update`, Composer reads the version constraints in `composer.json`, queries Packagist (or configured private repositories) for available package versions, and runs a dependency solver to find a set of versions satisfying every package's declared constraints simultaneously. The resolved versions are written to `composer.lock`, ensuring that running install again, even on a different machine, reproduces the exact same dependency tree. Composer also generates an autoloader, typically PSR-4 or PSR-0 compliant, that maps namespaces to file paths so PHP code can reference classes from installed packages without hand-written `require` or `include` statements. Composer's manifest-plus-lockfile model closely parallels npm's package.json and package-lock.json or Cargo's Cargo.toml and Cargo.lock, reflecting a pattern that became standard across many languages during the 2010s. Where Composer differs most from those peers is in its autoloading responsibility: because PHP has no built-in universal module system as centralized as Node's require or Python's import machinery, Composer's autoloader generation is a load-bearing part of how a typical PHP project actually accesses its dependencies at runtime, not just an installation convenience. In practice, essentially every modern PHP framework, including Laravel, Symfony, and WordPress plugins that adopt modern practices, is built assuming Composer manages its dependencies and autoloading. Developers add packages with `composer require vendor/package`, and frameworks ship their own first-party packages on Packagist that projects pull in the same way as any third-party library. Composer scripts, custom commands defined in composer.json, are also commonly used to wire up post-install tasks like cache clearing or asset building. The main limitation is that Composer's dependency resolution, like any solver working across a large public registry, can occasionally produce slow or conflicting resolutions in projects with many interdependent packages holding tight version constraints, and resolving those conflicts requires understanding semantic versioning constraints in composer.json. Teams generally mitigate this by keeping constraints as loose as reasonably safe and relying on composer.lock for reproducibility rather than pinning exact versions everywhere. Very large legacy codebases with many outdated, tightly pinned dependencies can still require manual intervention to untangle a resolution deadlock.
Key Features
- Resolves and installs PHP dependencies declared in composer.json
- Generates composer.lock to pin exact dependency versions for reproducibility
- Produces PSR-4/PSR-0 compliant autoloaders for installed packages
- Draws packages from the public Packagist repository or private registries
- Supports composer.json scripts for custom install and build hooks
- Used as the dependency foundation for major PHP frameworks
- Provides semantic-versioning-based constraint resolution across packages