Composer and Package Management

Composer is the de facto dependency manager for PHP. Rather than manually downloading libraries and wiring up include/require statements, you declare your project's dependencies and their version constraints in a composer.json file, and Composer resolves a compatible set of package versions, downloads them into a vendor/ directory, and generates an autoloader that makes every installed class available without manual require statements.

The require section of composer.json lists packages and version constraints using semantic versioning operators: ^8.1 allows any 8.x release at or above 8.1 but not 9.0, ~1.2 allows patch-level updates within 1.2.x, and an exact version like 3.4.0 pins precisely. Composer distinguishes require (production dependencies) from require-dev (tools only needed during development, like PHPUnit or a static analyzer), so production installs can exclude dev tooling entirely with --no-dev.

While composer.json expresses acceptable version ranges, composer.lock records the exact resolved version of every package (and its own transitive dependencies) that was installed. Running composer install reads the lock file and installs precisely those versions, guaranteeing every developer and every CI run gets an identical dependency tree; composer update instead re-resolves against composer.json's constraints and rewrites the lock file. Committing composer.lock to version control is standard practice for applications.

The autoload.psr-4 section maps namespace prefixes to directories, following the PSR-4 autoloading standard: a class Acme\Billing\Invoice maps to the file src/Invoice.php given the mapping above. Composer generates a vendor/autoload.php file that, once required at your application's entry point, transparently loads any class from any installed package (or your own project) on first use, without manual require statements anywhere in your code.