- Home
- Package Managers
- Composer
Composer
What it is
Composer manages dependencies for PHP projects by installing and updating the libraries a project declares. By default, it places dependencies in a directory within each project, and it also supports a global project for convenience. It provides dependency resolution, lockfiles, workspaces, private registry authentication, and offline installation. Packagist is the default package source; custom Composer, version control, and local path repositories are also supported. Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion. It can be installed locally or as a system-wide executable on Windows, Linux, and macOS. The latest version requires PHP 7.2.5 or later, while the 2.2.x LTS line supports PHP 5.3.2 and later. The audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. Composer is free and released under the MIT license. Its project warns that plugins and scripts can run with the user's permissions, and advises against running it as root with untrusted packages.
For and against
For
- Free and released under the MIT license.
- Supports lockfiles and dependency resolution.
- Works with Windows, Linux, and macOS.
- Audit command checks installed packages against advisories.
- Supports offline installation.
Against
- Latest version requires PHP 7.2.5 or later.
- Plugins and scripts can run with user permissions.
- Project advises against running as root with untrusted packages.
The verdict
Composer offers PHP dependency management across major desktop platforms, with repository integrations and an audit command. Check the PHP requirement for the version you plan to use, and treat plugins and scripts as executable code.
Who it suits
Composer suits PHP developers who need to install and update project libraries, including those working with lockfiles, private registries, or version control repositories. The 2.2.x LTS line may be relevant to projects using older PHP versions.
Plans and prices
Composer
PHP dependency management · MIT license
Read 4 Oct 2026 · getcomposer.org
On the record
- Archive tools
- For decompressing files, Composer relies on tools such as 7z, gzip, tar, unrar, unzip, and xz.getcomposer.org · read 4 Oct 2026
- Containers
- Composer is published as a Docker container, and its documentation shows how to run install against a mounted project directory.getcomposer.org · read 4 Oct 2026
- Dependency resolution
- Composer determines which package versions need to be installed and can update all dependencies in one command.getcomposer.org · read 4 Oct 2026
- Installation options
- Composer can be installed locally in a project or globally as a system wide executable.getcomposer.org · read 4 Oct 2026
- Installer verification
- The download instructions verify the installer using its SHA-384 hash before running it.getcomposer.org · read 4 Oct 2026
- Install verification
- The download instructions verify the installer using a SHA-384 hash before running it.getcomposer.org · read 4 Oct 2026
- License
- Composer and the content on its site are released under the MIT license.getcomposer.org · read 4 Oct 2026
- Lockfile support
- Yesgetcomposer.org · read 21 Sep 2026
- Offline installation
- Yesgetcomposer.org · read 21 Sep 2026
- Package formats
- PHP packages; ZIP; TAR; VCS repositoriesgetcomposer.org · read 21 Sep 2026
- Package sources
- Composer uses Packagist by default and supports custom Composer, VCS, and local path repositories.getcomposer.org · read 4 Oct 2026
- PHP requirement
- The latest Composer version requires PHP 7.2.5 or later.getcomposer.org · read 4 Oct 2026
- PHP requirements
- The latest Composer version requires PHP 7.2.5; the 2.2.x LTS line supports PHP 5.3.2 and later.getcomposer.org · read 4 Oct 2026
- Platform support
- Composer says it is designed to run on Windows, Linux, and macOS.getcomposer.org · read 4 Oct 2026
- Private registry auth
- Yesgetcomposer.org · read 21 Sep 2026
- Project scope
- Composer installs dependencies in a directory within each project by default, and also supports a global project for convenience.getcomposer.org · read 4 Oct 2026
- Purpose
- Composer is a tool for managing PHP project dependencies, installing and updating the libraries a project declares.getcomposer.org · read 4 Oct 2026
- Release maintenance
- The 2.10.x release line receives bug and security fixes until the next minor release; the 2.2.x LTS line receives critical security fixes through at least 2026-12-31.getcomposer.org · read 4 Oct 2026
