Composer

Dependency manager for PHP that declares and installs project libraries. Works on a per-project basis, installing packages into a vendor directory rather than globally, and is inspired by npm and Bundler.

Composer is the de facto standard for PHP dependency management. Packagist.org aggregates public PHP packages installable with Composer. The solver uses a PHP port of openSUSE's Libzypp satsolver for dependency resolution. Recent releases add automatic security blocking and supply chain transparency features.

Key capabilities:

• Declare dependencies in composer.json with semantic version constraints
• Lock file for reproducible builds across environments
• PSR-4, PSR-0, classmap, and file autoloading from vendor/autoload.php
• Support for Git, Mercurial, Subversion, Perforce, and Fossil as package sources
• Platform packages for PHP version and extension requirements
• Docker images for CI and containerized workflows

PHP developers use Composer to manage libraries in frameworks like Laravel and Symfony, bootstrap new applications, and keep dependencies up to date. The composer audit command discovers known security advisories. Private package hosting is available via Private Packagist for teams sharing proprietary code.