Composer: PHP Dependency Manager

The PHP ecosystem has undergone a dramatic transformation in recent years, and much of this change can be attributed to one tool: Composer. At ZIRA Software, Composer has become an indispensable part of our development workflow, streamlining dependency management and enabling us to leverage thousands of packages from the PHP community.

What is Composer?

Composer is a dependency management tool for PHP that allows you to declare the libraries your project depends on and manages (installs/updates) them for you. Think of it as npm for Node.js or gem for Ruby—but specifically designed for PHP's needs.

Before Composer, managing PHP dependencies was painful. Developers manually downloaded libraries, dealt with conflicting versions, and struggled with autoloading. Composer solves these problems elegantly.

Installing Composer

Getting started with Composer is straightforward. On Unix/Linux/Mac:

curl -sS https://getcomposer.org/installer | php
mv composer.phar /usr/local/bin/composer

On Windows, download and run the Composer-Setup.exe.

Verify the installation:

composer --version

Your First composer.json

The composer.json file is the heart of Composer. It declares your project's dependencies and metadata:

{
    "name": "zirasoftware/client-project",
    "description": "Client project management system",
    "require": {
        "php": ">=5.4.0",
        "laravel/framework": "4.2.*",
        "intervention/image": "~2.0",
        "guzzlehttp/guzzle": "~4.0"
    },
    "require-dev": {
        "phpunit/phpunit": "4.0.*",
        "mockery/mockery": "0.9.*"
    },
    "autoload": {
        "psr-4": {
            "ZIRA Software\\": "app/"
        }
    }
}

Installing Dependencies

Once you've defined your composer.json, install dependencies with:

composer install

This command:

1. Reads composer.json
2. Resolves dependencies
3. Downloads packages to vendor/
4. Creates composer.lock (locks exact versions)
5. Generates autoload files

The vendor/ directory contains all your dependencies. Never commit this to version control—add it to .gitignore:

/vendor
composer.lock  # Some teams commit this, some don't

Understanding Version Constraints

Composer uses semantic versioning with flexible version constraints:

{
    "require": {
        "monolog/monolog": "1.0.0",      // Exact version
        "symfony/console": "~2.5",       // >=2.5.0 <2.6.0
        "doctrine/orm": "2.*",           // >=2.0.0 <3.0.0
        "guzzle/guzzle": ">=3.7",        // 3.7.0 or higher
        "twig/twig": "^1.24"             // >=1.24 <2.0.0
    }
}

Best practices:

• Use ~ or ^ for flexibility with safety
• Lock exact versions only for critical dependencies
• Use require-dev for development-only packages

The Autoloader: PSR-4 and PSR-0

One of Composer's best features is its autoloader, which implements PSR-4 and PSR-0 standards:

<?php

require 'vendor/autoload.php';

// Now you can use any class from your dependencies
use Guzzle\Http\Client;
use Intervention\Image\ImageManagerStatic as Image;

$client = new Client();
$image = Image::make('photo.jpg')->resize(300, 200);

Define your own autoloading in composer.json:

{
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "App\\Controllers\\": "app/controllers/"
        },
        "files": [
            "app/helpers.php"
        ]
    }
}

After modifying autoload definitions, regenerate the autoloader:

composer dump-autoload

Finding Packages: Packagist.org

Packagist is the main Composer repository, hosting over 50,000 packages. Some essential packages we use at ZIRA Software:

Laravel Ecosystem:

• laravel/framework - The Laravel framework
• barryvdh/laravel-debugbar - Development debugger
• intervention/image - Image manipulation

General PHP:

• guzzlehttp/guzzle - HTTP client
• monolog/monolog - Logging library
• swiftmailer/swiftmailer - Email library
• phpunit/phpunit - Testing framework

Creating Your Own Package

Want to share your code? Creating a Composer package is simple:

1. Create your package structure:

my-package/
├── src/
│   └── MyClass.php
├── tests/
│   └── MyClassTest.php
├── composer.json
└── README.md

2. Define your composer.json:

{
    "name": "zirasoftware/my-package",
    "description": "My awesome package",
    "type": "library",
    "license": "MIT",
    "authors": [
        {
            "name": "ZIRA Software",
            "email": "contact@zirasoftware.com"
        }
    ],
    "require": {
        "php": ">=5.4.0"
    },
    "autoload": {
        "psr-4": {
            "ZIRA Software\\MyPackage\\": "src/"
        }
    }
}

3. Submit to Packagist:
   • Create account on Packagist.org
   • Submit your GitHub/GitLab repository URL
   • Configure webhooks for automatic updates

Composer Commands You Should Know

# Install dependencies
composer install

# Update dependencies to latest versions
composer update

# Update a specific package
composer update vendor/package

# Add a new dependency
composer require guzzlehttp/guzzle

# Add a dev dependency
composer require --dev phpunit/phpunit

# Remove a dependency
composer remove vendor/package

# Show available updates
composer outdated

# Validate composer.json
composer validate

# Search for packages
composer search monolog

# Show package details
composer show monolog/monolog

composer.lock: Version Locking

The composer.lock file locks exact versions of all dependencies and their dependencies. This ensures everyone on your team uses identical versions.

Workflow:

1. Developer runs composer install → reads composer.lock
2. Developer adds package with composer require → updates composer.lock
3. Team members run composer install → gets exact same versions

Best practice: Commit composer.lock to version control for applications (but not for libraries).

Optimizing for Production

Before deploying to production, optimize Composer's autoloader:

composer install --no-dev --optimize-autoloader

This:

• Skips development dependencies (--no-dev)
• Creates optimized class maps (--optimize-autoloader)

For even better performance, use --classmap-authoritative:

composer dump-autoload --classmap-authoritative

Private Packages with Satis

Need to host private packages? Use Satis, a static Composer repository generator:

{
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.zirasoftware.com"
        }
    ],
    "require": {
        "zirasoftware/private-package": "^1.0"
    }
}

Common Issues and Solutions

Issue: Memory limit errors

php -d memory_limit=-1 /usr/local/bin/composer install

Issue: Slow installation

# Enable parallel downloads (Composer 2.0+)
composer install --prefer-dist

Issue: Conflicting dependencies

# See why a package is installed
composer why vendor/package

# See why a package is NOT installed
composer why-not vendor/package

Composer in Our Workflow at ZIRA Software

Here's how we use Composer in our development workflow:

1. Project Initialization:

   composer create-project laravel/laravel client-project
   cd client-project

2. Adding Project-Specific Dependencies:

   composer require intervention/image
   composer require --dev barryvdh/laravel-debugbar

3. Deployment:

   composer install --no-dev --optimize-autoloader

4. Continuous Integration: Our CI servers run composer install before every test run to ensure dependencies are current.

The Future of PHP Development

Composer has fundamentally changed how we build PHP applications. The ability to easily share and reuse code has led to an explosion of high-quality packages and frameworks. Laravel's rapid rise to prominence would have been impossible without Composer.

Conclusion

Composer is no longer optional—it's essential for professional PHP development. Whether you're building a simple website or a complex enterprise application, Composer streamlines dependency management and enables you to leverage the best packages the PHP community has to offer.

At ZIRA Software, every PHP project starts with composer init. The time invested in learning Composer pays dividends in productivity, code quality, and maintainability.

Ready to modernize your PHP development workflow? Contact ZIRA Software to discuss how we can help build your next project with modern PHP practices and tools.