Weave Code
Composer Laravel Package
composer/composer
Composer is the dependency manager for PHP. Declare project requirements, install/update packages, and manage autoloading with a lock file for repeatable builds. Works with Packagist and VCS repositories; runs via CLI on PHP 7.2.5+ (latest).
Dependency Manager for PHP
Frequently asked questions about Composer
- What’s the minimum Composer version required for Laravel 10.x projects?
- Laravel 10.x officially requires **Composer 2.5+** (PHP 8.1+). For PHP 7.4 support, use **Composer 2.2 LTS**, but ensure your CI/CD enforces version pinning (e.g., `composer.json` `config.platform.check` or workflow scripts). Always test upgrades with `composer update --dry-run`.
- How do I enforce security checks for Laravel dependencies in Composer?
- Enable `audit > block-insecure: true` in `composer.json` to block vulnerable packages. Run `composer audit` in CI (e.g., GitHub Actions) and add it as a mandatory gate. For false positives, whitelist advisories in `composer.json` under `config > allow-plugins` or use `composer why-not` to debug.
- Can Composer handle private Laravel packages (e.g., internal APIs)?
- Yes. Use **Private Packagist** or Satis to host private packages. Configure `repositories` in `composer.json` with auth tokens (e.g., `type: composer`, `url: https://satis.example.com`). For Laravel, ensure `autoload` includes private package namespaces, and use `composer dump-autoload` after updates.
- Why does `composer install` fail on Laravel projects with ‘Could not open input file’ errors?
- This typically occurs due to missing **binary dependencies** (e.g., `git`, `unzip`) or incorrect PHP versions. Verify your environment has `git`, `unzip`, and PHP 7.2.5+ (or 8.1+ for Laravel 10). Use Docker (e.g., `composer:cli`) or CI tools like GitHub Actions with preinstalled dependencies to avoid this.
- How do I optimize Composer for large Laravel monoliths (100+ dependencies)?
- Use `--optimize-autoloader` and `--no-dev` in production to reduce install times. Profile with `composer diagnose` and enable **Composer 2.10+** for malware scanning and solver optimizations. For CI, cache `vendor/` and use `--prefer-dist` to skip Git clones. Consider splitting dependencies into sub-projects if feasible.
- What’s the difference between `composer update` and `composer install` for Laravel?
- `composer install` uses `composer.lock` for exact versions (safe for production). `composer update` updates packages to `composer.json` ranges (risky for production). For Laravel, always run `composer install` in production and `update` only in staging with `php artisan optimize` afterward. Use `--prefer-stable` to avoid major version bumps.
- How do I debug Composer plugin conflicts in a Laravel project?
- Run `composer --no-plugins diagnose` to identify conflicts. Disable plugins temporarily with `--no-plugins` and check for version mismatches in `composer.json`. Laravel plugins (e.g., `laravel/pint`) may clash with global Composer plugins. Isolate the issue by testing in a clean environment or using `composer config --global disable-tls true` for network debugging.
- Is Composer 2.x backward compatible with Laravel 8.x (PHP 7.4)?
- Yes, but **only Composer 2.2 LTS** supports PHP 7.4. Avoid Composer 2.5+ (PHP 8.1+). Pin the version in `composer.json` (`config.platform.check=false` may help). For upgrades, test with `composer update --dry-run` and use `composer why` to resolve dependency conflicts before applying changes.
- How can I cache Composer dependencies in GitHub Actions for faster Laravel CI?
- Use GitHub’s `actions/cache` to restore `vendor/` between runs. Add this to your workflow: `cache: { paths: [vendor] }`. For Composer 2, also cache `~/.cache/composer` (exclude `files` and `http_cache`). Enable `--prefer-dist` to skip Git clones and reduce cache bloat. Test with `composer validate` to ensure cache integrity.
- Are there alternatives to Composer for Laravel dependency management?
- No direct alternatives exist for Laravel’s core ecosystem, as it **explicitly requires Composer**. Tools like **PHP-Dependency-Manager (phpdm)** or **Rector** focus on code transformation, not dependency resolution. For private repos, **Satis** or **Private Packagist** complement Composer. If avoiding Composer entirely, you’d need to rewrite Laravel’s `vendor/` integration (e.g., manual `require_once` loading).
Weaver
How can I help you explore Laravel packages today?