Weave Code
Composer Laravel Package
composer/composer
Composer is the dependency manager for PHP, letting you declare, manage, and install project dependencies from Packagist. It handles autoloading, version constraints, and locking so installs stay reproducible across environments.
Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere.
Frequently asked questions about Composer
- How do I install Composer for a Laravel project?
- Install Composer by following the official instructions at getcomposer.org, then run composer install in your Laravel project directory. Laravel projects already include a composer.json file, so Composer resolves the framework and package dependencies into vendor. Verify the install with composer --version before deploying.
- Which Composer version supports my Laravel and PHP version?
- Laravel relies on Composer for package resolution and autoloading, so Composer is required across supported Laravel versions. The latest Composer requires PHP 7.2.5 or above, while Composer 2.2 LTS supports PHP 5.3.2 through 8.1 for older applications. The installer and self-update command automatically select the appropriate Composer version for your PHP runtime.
- What is the difference between composer install and composer update in Laravel deployments?
- composer install reads composer.lock and installs the exact dependency versions recorded there, which makes builds reproducible across CI, staging, and production. composer update resolves newer versions and rewrites the lockfile, so it should be intentional and committed. Production and deployment workflows should use composer install with the lockfile committed.
- How do I run Laravel artisan commands automatically after Composer install or update?
- Add scripts such as post-install-cmd and post-update-cmd to composer.json and call Laravel commands with @php artisan. Common examples include php artisan optimize and php artisan config:cache, and the context also shows key generation during install. Keep these scripts deployment-aware, since they run in whatever environment Composer executes.
- How do I audit Laravel Composer dependencies for security vulnerabilities?
- Run composer audit in CI and fail the build when advisories are reported. You can also enforce blocking behavior with Composer configuration such as audit.block-insecure to prevent vulnerable packages from being installed. Remember that composer audit checks dependencies, not the Composer binary itself, so patch the tool separately.
- What changed in the Composer 2.2.30 security release?
- Composer 2.2.30 is a security-hardening patch on the 2.2 LTS line, not a feature release. The bin path validation change tracked as GHSA-96h3-5x6v-m776 and CVE-2026-59944 affects how Composer resolves vendor/bin symlinks during install, which matters for deployments using phpunit, pint, phpstan, and similar binaries. Behavior is unchanged for conformant packages, but the enforcement point is now in the install path. This is a tooling vulnerability, so composer audit will not detect it and the Composer binary must be patched separately.
- Can Composer manage private Laravel packages?
- Yes, Composer supports private package hosting through private VCS repositories, custom repository definitions in composer.json, and services such as Private Packist. You configure authentication credentials securely in CI or locally so Composer can resolve private Laravel packages. Avoid committing secrets and prefer environment-based auth for deployments.
- How do I speed up Composer installs in Laravel CI/CD?
- Use composer install instead of update, add --no-dev and --optimize-autoloader for production builds, and prefer dist installs. Composer 2 parallel downloads, classmap dumping, and PoolOptimizer help reduce build time, and caching the Composer cache directory in CI gives further gains. These optimizations preserve lockfile reproducibility.
- How do I pin a patched Composer version in Laravel Sail, Docker, or Forge deployments?
- In Docker or Sail, pin the Composer image tag to a patched version such as composer:2.2.30 or the current patched line instead of latest. For Forge and Envoyer, make sure deployment scripts use a pinned Composer binary and assert composer --version in CI. This prevents deployments from silently using an unpatched tooling version.
- Is Composer still the standard for Laravel, or are there alternatives?
- Composer remains the de facto standard for PHP dependency management, and Laravel itself relies on it for package resolution, autoloading, and dependency injection. There is no practical alternative package manager for Laravel's Composer-based ecosystem, with public packages on Packagist and private hosting available through Private Packagist or custom repositories. Teams should treat Composer as foundational infrastructure and keep it patched.
Weaver
How can I help you explore Laravel packages today?