Composer vs Dart pub
Composer
getcomposer.org
Dart pub
dart.devSide by side
| Figure | Composer | Dart pub |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 0 |
| Spec score · Package Managers | 8.9 (#5) | 7.8 (#46) |
| Dependency resolution | Composer determines which package versions need to be installed and can update all dependencies in one command. | Pub manages dependency versions to find versions compatible with each other and with the Dart SDK version. |
| Free plan | Yes | Yes |
| Lockfile support | Yes | Yes |
| Offline installation | Yes | Yes |
| Package formats | PHP packages; ZIP; TAR; VCS repositories | Dart packages |
| Package sources | Composer uses Packagist by default and supports custom Composer, VCS, and local path repositories. | Packages can come from pub.dev, the local file system, or other locations such as Git repositories. |
| Private registry auth | Yes | Yes |
| Purpose | Composer is a tool for managing PHP project dependencies, installing and updating the libraries a project declares. | Pub is Dart’s package manager for managing package dependencies. |
| Supported platforms | PHP; Windows; Linux; macOS | Windows,Linux,macOS |
| Workspace support | Yes | Yes |
Plans
In their own words
Composer
Composer manages dependencies for PHP projects, installing and updating the libraries each project declares. By default, it keeps those dependencies in a directory within the project, and it can also manage a global project. It resolves dependencies and supports lockfiles, workspaces, private registry authentication, and offline installation. Packagist is its default package source; custom Composer, version-control, and local-path repositories are also supported. Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion. It can be installed locally or as a system-wide executable on Windows, Linux, and macOS. The latest version requires PHP 7.2.5 or later; the 2.2.x LTS line supports PHP 5.3.2 and later. Its audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. Composer is free under the MIT license. Plugins and scripts can run with the user's permissions, so the project advises against running Composer as root with untrusted packages.
Dart pub
Dart pub is Dart’s package manager for finding and managing shared libraries and tools. It resolves dependency versions compatible with one another and the installed Dart SDK, and records selected versions in a lockfile so application teams can keep dependency versions consistent. Packages may come from pub.dev, other hosted repositories, Git repositories, local paths, or supported SDKs. Developers can use pub through the dart or Flutter command-line tools, and most Dart-savvy IDEs support package workflows. The `dart pub publish` command uploads packages to pub.dev. Before publishing, pub checks for possible secret leaks using limited patterns and may warn or refuse publication; packages published to pub.dev cannot have Git or local path dependencies in their pubspec. Security advisories draw on the GitHub Advisory Database for Dart and Flutter packages. Pub can often resolve dependencies offline from its shared cache. It supports Windows, Linux, and macOS, and is free and open source.