Composer
Composer manages dependencies for PHP projects, installing and updating the libraries a project declares.
What Composer is
Composer manages dependencies for PHP projects, installing and updating the libraries a project declares. By default, it puts dependencies in a directory within each project, and it can also manage a global project for convenience. It supports dependency resolution, lockfiles, workspaces, private registry authentication, and offline installation. Packagist is its default package source; custom Composer, version control, and local path repositories are also supported. Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion. It can be installed locally or globally on Windows, Linux, and macOS, and the Windows installer sets up PATH for command-line use. The latest version requires PHP 7.2.5 or later, while the 2.2.x LTS line supports PHP 5.3.2 and later. The audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. Composer is free and released under the MIT license. Its project warns that plugins and scripts can run with the user's permissions, and advises against running it as root with untrusted packages.
Good
- Installs dependencies per project by default
- Supports lockfiles and offline installation
- Audits packages for security advisories and policies
- Free and released under the MIT license
Watch out
- Latest version requires PHP 7.2.5 or later
- Plugins and scripts can run with user permissions
Who it suits
Composer suits PHP developers who need to install and update project libraries across Windows, Linux, or macOS. Its package auditing and repository options may also suit teams managing dependency policies or custom package sources.
Verdict
Composer provides dependency management, repository support, and package auditing for PHP projects at no charge. Take care with plugins and scripts, especially when working with untrusted packages.
Plans and prices
From Composer's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Composer | Free | PHP dependency management · MIT license |
The facts
Each one read from Composer's own pages, with the date it was checked.
What it does
- Archive tools
- For decompressing files, Composer relies on tools such as 7z, gzip, tar, unrar, unzip, and xz.checked 4 Oct 2026
- Containers
- Composer is published as a Docker container, and its documentation shows how to run install against a mounted project directory.checked 4 Oct 2026
- Dependency resolution
- Composer determines which package versions need to be installed and can update all dependencies in one command.checked 4 Oct 2026
- Installation options
- Composer can be installed locally in a project or globally as a system wide executable.checked 4 Oct 2026
- Installer verification
- The download instructions verify the installer using its SHA-384 hash before running it.checked 4 Oct 2026
- Install verification
- The download instructions verify the installer using a SHA-384 hash before running it.checked 4 Oct 2026
- License
- Composer and the content on its site are released under the MIT license.checked 4 Oct 2026
- Lockfile support
- Yeschecked 21 Sep 2026
- Offline installation
- Yeschecked 21 Sep 2026
- Package formats
- PHP packages; ZIP; TAR; VCS repositorieschecked 21 Sep 2026
- Package sources
- Composer uses Packagist by default and supports custom Composer, VCS, and local path repositories.checked 4 Oct 2026
- PHP requirement
- The latest Composer version requires PHP 7.2.5 or later.checked 4 Oct 2026
- PHP requirements
- The latest Composer version requires PHP 7.2.5; the 2.2.x LTS line supports PHP 5.3.2 and later.checked 4 Oct 2026
- Private registry auth
- Yeschecked 21 Sep 2026
- Project scope
- Composer installs dependencies in a directory within each project by default, and also supports a global project for convenience.checked 4 Oct 2026
- Purpose
- Composer is a tool for managing PHP project dependencies, installing and updating the libraries a project declares.checked 4 Oct 2026
- Release maintenance
- The 2.10.x release line receives bug and security fixes until the next minor release; the 2.2.x LTS line receives critical security fixes through at least 2026-12-31.checked 4 Oct 2026
- Repository integrations
- Composer supports Fossil, Git, Mercurial, Perforce, and Subversion repositories.checked 4 Oct 2026
- Security auditing
- The composer audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies.checked 4 Oct 2026
- Security caution
- Composer warns that plugins and scripts can execute with the user's permissions and advises against running it as root for untrusted packages.checked 4 Oct 2026
- Sponsor support
- Silver and Gold sponsors receive a shared Slack channel and priority issue or bug response on GitHub.checked 4 Oct 2026
Money
- Free plan
- Yeschecked 21 Sep 2026
Where it runs
- Platforms
- Composer says it is multi-platform and aims to run on Windows, Linux, and macOS.checked 4 Oct 2026
- Platform support
- Composer says it is designed to run on Windows, Linux, and macOS.checked 4 Oct 2026
