Composer Essentials

Composer is PHP's dependency manager. composer.json declares requirements with version constraints; composer.lock records the exact resolved versions. Commit both for applications. composer install installs exactly what the lock file says (use in CI/production); composer update resolves new versions and rewrites the lock. Separate dev dependencies (require-dev) and use --no-dev --optimize-autoloader for production installs.

{
  "name": "acme/shop",
  "require": {
    "php": "^8.3",
    "guzzlehttp/guzzle": "^7.9",
    "monolog/monolog": "^3.7"
  },
  "require-dev": {
    "phpunit/phpunit": "^11.0",
    "phpstan/phpstan": "^2.0"
  },
  "autoload": { "psr-4": { "App\\": "src/" } },
  "autoload-dev": { "psr-4": { "Tests\\": "tests/" } },
  "scripts": { "test": "phpunit", "analyse": "phpstan analyse" },
  "config": { "sort-packages": true }
}

composer require symfony/http-client         # add a dependency
composer install --no-dev --optimize-autoloader --classmap-authoritative   # production
composer outdated --direct                   # what can be upgraded
composer audit                               # known security advisories

Common pitfalls

• Running composer update in production instead of install.
• Not committing composer.lock for applications.
• Using * or very loose constraints that pull breaking major versions.

Key points

• composer.lock pins exact versions
• install in CI/prod, update deliberately
• Run composer audit regularly

Further reading: Composer documentation