Composer
getcomposer.org
What it is
Composer manages dependencies for PHP projects, installing and updating the libraries each project declares. By default, it keeps those dependencies in a directory within the project, and it can also manage a global project. It resolves dependencies and supports lockfiles, workspaces, private registry authentication, and offline installation. Packagist is its default package source; custom Composer, version-control, and local-path repositories are also supported. Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion. It can be installed locally or as a system-wide executable on Windows, Linux, and macOS. The latest version requires PHP 7.2.5 or later; the 2.2.x LTS line supports PHP 5.3.2 and later. Its audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. Composer is free under the MIT license. Plugins and scripts can run with the user's permissions, so the project advises against running Composer as root with untrusted packages.
Spec sheet
- Purpose
- Composer is a tool for managing PHP project dependencies, installing and updating the libraries a project declares.Read 4 Oct 2026 · getcomposer.org
- Platforms
- Composer says it is multi-platform and aims to run on Windows, Linux, and macOS.Read 4 Oct 2026 · getcomposer.org
- Free plan
- YesRead 21 Sep 2026 · getcomposer.org
- Support
- The project says commercial support and consulting are available through its sponsorship page.Read 4 Oct 2026 · getcomposer.org
- License
- Composer and the content on its site are released under the MIT license.Read 4 Oct 2026 · getcomposer.org
- Archive tools
- For decompressing files, Composer relies on tools such as 7z, gzip, tar, unrar, unzip, and xz.Read 4 Oct 2026 · getcomposer.org
- Containers
- Composer is published as a Docker container, and its documentation shows how to run install against a mounted project directory.Read 4 Oct 2026 · getcomposer.org
- Dependency resolution
- Composer determines which package versions need to be installed and can update all dependencies in one command.Read 4 Oct 2026 · getcomposer.org
- Install verification
- The download instructions verify the installer using a SHA-384 hash before running it.Read 4 Oct 2026 · getcomposer.org
- Installation options
- Composer can be installed locally in a project or globally as a system wide executable.Read 4 Oct 2026 · getcomposer.org
- Installer verification
- The download instructions verify the installer using its SHA-384 hash before running it.Read 4 Oct 2026 · getcomposer.org
- Lockfile support
- YesRead 21 Sep 2026 · getcomposer.org
- Offline installation
- YesRead 21 Sep 2026 · getcomposer.org
- Package formats
- PHP packages; ZIP; TAR; VCS repositoriesRead 21 Sep 2026 · getcomposer.org
- Package sources
- Composer uses Packagist by default and supports custom Composer, VCS, and local path repositories.Read 4 Oct 2026 · getcomposer.org
- PHP requirement
- The latest Composer version requires PHP 7.2.5 or later.Read 4 Oct 2026 · getcomposer.org
- PHP requirements
- The latest Composer version requires PHP 7.2.5; the 2.2.x LTS line supports PHP 5.3.2 and later.Read 4 Oct 2026 · getcomposer.org
- Platform support
- Composer says it is designed to run on Windows, Linux, and macOS.Read 4 Oct 2026 · getcomposer.org
- Private registry auth
- YesRead 21 Sep 2026 · getcomposer.org
- Project scope
- Composer installs dependencies in a directory within each project by default, and also supports a global project for convenience.Read 4 Oct 2026 · getcomposer.org
- Release maintenance
- The 2.10.x release line receives bug and security fixes until the next minor release; the 2.2.x LTS line receives critical security fixes through at least 2026-12-31.Read 4 Oct 2026 · getcomposer.org
- Repository integrations
- Composer supports Fossil, Git, Mercurial, Perforce, and Subversion repositories.Read 4 Oct 2026 · getcomposer.org
- Security auditing
- The composer audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies.Read 4 Oct 2026 · getcomposer.org
- Security caution
- Composer warns that plugins and scripts can execute with the user's permissions and advises against running it as root for untrusted packages.Read 4 Oct 2026 · getcomposer.org
- Sponsor support
- Silver and Gold sponsors receive a shared Slack channel and priority issue or bug response on GitHub.Read 4 Oct 2026 · getcomposer.org
- Support and funding
- The Composer site says commercial support and consulting are available through its sponsorship page.Read 4 Oct 2026 · getcomposer.org
- Supported legacy PHP
- The 2.2.x LTS release line supports PHP 5.3.2 and later and receives critical security fixes through at least 2026-12-31.Read 4 Oct 2026 · getcomposer.org
- Supported platforms
- PHP; Windows; Linux; macOSRead 21 Sep 2026 · getcomposer.org
- Version control integrations
- Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion.Read 4 Oct 2026 · getcomposer.org
- Windows installation
- The Windows installer installs the latest Composer version and sets up PATH so it can be called from any command line directory.Read 4 Oct 2026 · getcomposer.org
- Workspace support
- YesRead 21 Sep 2026 · getcomposer.org
Plans and prices
Composer Free PHP dependency management · MIT license Read 4 Oct 2026 · getcomposer.org
Strong points and limits
Strong points
- Supports dependency resolution and lockfiles
- Works with several version-control systems
- Can install dependencies offline
- Audits packages for security and policy concerns
Limits
- Latest version requires PHP 7.2.5 or later
- Plugins and scripts can run with user permissions
Who it suits
Composer suits PHP developers managing project libraries, including those who need lockfiles, offline installation, or varied repository sources. Its legacy LTS line supports projects using PHP 5.3.2 and later.
Verdict
Composer covers common PHP dependency workflows, from project-level installs to package auditing. Check its PHP requirement and take care with untrusted plugins or scripts.
Where Specifiction places it
- Package Managers#5 of 938.9
