composer-tooling

Composer Tooling (stack-agnostic)

Composer is the dependency manager and autoloader entry point for every modern PHP project. Read composer.json before doing anything else — it tells you the PHP version, the framework, and the available packages.

Project detection

cat composer.json                 # PHP version (require.php), framework, scripts
test -f composer.lock && echo "locked"   # lockfile present → reproducible installs

Key fields to read:

• require.php — minimum PHP version (drives which language features you may use).
• require — runtime dependencies; the framework marker lives here (laravel/framework, symfony/framework-bundle).
• require-dev — dev/test tooling (phpunit, pest, phpstan, pint, php-cs-fixer).
• autoload.psr-4 — namespace → directory map.
• config.platform.php — pins the version the resolver targets (may differ from the runtime PHP).

composer.json vs composer.lock

• composer.json declares intent — version ranges you accept.
• composer.lock records the exact resolved versions. It is committed and is the source of truth for composer install.

Command	Effect
composer install	Installs the exact versions from composer.lock. Use in CI/deploy.
composer update <pkg>	Re-resolves the named package, rewrites the lock. Use deliberately.
composer require <pkg>	Adds to composer.json + updates the lock for that package.
composer require --dev <pkg>	Same, into require-dev.

Never hand-edit composer.lock. Never run a bare composer update (updates everything) as part of a focused feature change.

Version constraints

{
  "require": {
    "php": "^8.2",              // >=8.2.0 <9.0.0 — recommended for libraries/apps
    "guzzlehttp/guzzle": "^7.8" // caret: compatible up to the next major
  }
}

• Caret ^7.8 — allows >=7.8.0 <8.0.0. The default; respects SemVer.
• Tilde ~7.8.0 — allows >=7.8.0 <7.9.0. Tighter; use when you must pin to a minor.
• Exact 7.8.3 — avoid except to work around a specific broken release.
• Avoid * and unbounded >= — they break reproducibility.