Composer

Nils Adermann and Jordi Boggiano wrote Composer. The first open release was in 2012. Packages mostly sit in the Packagist registry. composer.json is the project's package list. composer.lock pins the exact version. composer install reads that list and puts the packages in the vendor folder. PHP runs the program. Composer only brings the library and does not run the page itself.

Composer is for installing a ready library into a PHP project and repeating the same list on another computer.

• Installing a framework itself with one command
• Keeping the version with composer.lock
• Separating the package in the vendor folder
• Replacing an old package with a newer one

With Composer you add a package and install from the list. It does not replace PHP. A package you do not know puts its own code inside your project. Putting the vendor folder in the repo is usually not needed. The list and the lock file are enough.

Installing one package is easy. The difficulty is the PHP version and the lock file. A package may ask for a newer PHP than yours, and the install stops. Throwing away composer.lock can bring another version tomorrow. If two projects write to the same shared folder, the versions mix.

Advantage: a library is not rewritten, the list stays in one file, and the same install repeats on another machine. Limit: vendor grows. Not every small job needs a package. Composer is not pip and it is not npm.

A package has a name and a version. composer.json is the list. vendor is the place of the downloaded files.

• composer.json keeps the list
• composer.lock pins the version
• vendor is the packages' folder
• Packagist is the shared registry

This command installs the packages from the list into the vendor folder. It does not write the PHP program itself.

composer install

• Are Composer and PHP the same? No. PHP runs the program. Composer brings the library.
• Are Composer, pip, and npm the same? The job is similar, the tool is separate. Composer is for PHP.
• Should the vendor folder stay in the repo? Usually no. The list and the lock file stay, and the packages arrive at install time.