Getting Started

Install the package via Composer:

composer require composer/metadata-minifier

For your first use case, minify an existing composer.lock file to reduce its size and noise:

vendor/bin/composer-metadata-minifier

This will overwrite the current composer.lock with a minified version. To test without modifying your lockfile, use the --output flag:

vendor/bin/composer-metadata-minifier --output=minified.lock

Compare the output with diff composer.lock minified.lock to see the reduction in metadata.

Implementation Patterns

CI/CD Integration

Add a script to your composer.json to automate minification in CI:

"scripts": {
    "post-update-cmd": [
        "@php vendor/bin/composer-metadata-minifier"
    ]
}

Trigger it in CI after dependency resolution (e.g., composer install). This ensures only minified lockfiles are committed.

Pre-commit Hook

Use a pre-commit hook (e.g., via Husky or pre-commit) to auto-minify composer.lock before commits:

#!/bin/sh
vendor/bin/composer-metadata-minifier
git add composer.lock

This prevents uncompressed metadata from being accidentally committed.

Selective Preservation

If your workflow relies on specific metadata (e.g., extra fields), preserve them via a config file:

vendor/bin/composer-metadata-minifier --preserve=extra

Or define a .composer-metadata-minifier.json config:

{
    "preserve": ["extra", "source.sha"]
}

Laravel-Specific Workflow

For Laravel projects, integrate minification into a custom Artisan command:

// app/Console/Commands/MinifyLockfile.php
namespace App\Console\Commands;

use Illuminate\Console\Command;
use Composer\MetadataMinifier\MetadataMinifier;

class MinifyLockfile extends Command
{
    protected $signature = 'lock:minify';
    protected $description = 'Minify composer.lock';

    public function handle()
    {
        $lockfile = file_get_contents('composer.lock');
        $data = json_decode($lockfile, true);
        $minified = MetadataMinifier::minify($data);
        file_put_contents('composer.lock', json_encode($minified, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
        $this->info('Lockfile minified!');
    }
}

php artisan lock:minify

Gotchas and Tips

Irreversible Changes

Minification removes metadata permanently (e.g., source.sha, dist-sha256). Always:
- Run it after composer update/install.
- Backup composer.lock before minifying.

Git Conflicts

If some team members run minification locally and others don’t, conflicts will arise. Enforce consistency:
- Use a pre-commit hook to auto-minify.
- Add a CI check to fail if composer.lock isn’t minified.

Debugging Minification

If minified output breaks builds, compare the original and minified files:
```
diff composer.lock minified.lock
```
Use --preserve to retain critical fields (e.g., extra for custom scripts).

Laravel-Specific Pitfalls

Cache Invalidation: After minifying, clear Laravel caches:
```
php artisan config:clear
php artisan cache:clear
```
Dependency Conflicts: If using Laravel’s composer.lock in a monorepo, ensure minification doesn’t break shared dependencies.

Performance Considerations

Minification is fast (O(n) complexity), but avoid running it in production (only in CI/dev).
For large projects, test with composer validate post-minification.

Extension Points

Custom Minifiers: Extend MetadataMinifier to handle project-specific metadata:

use Composer\MetadataMinifier\MetadataMinifier;

class CustomMinifier extends MetadataMinifier {
    protected function shouldPreserve($key) {
        return parent::shouldPreserve($key) || in_array($key, ['custom.field']);
    }
}

Post-Minification Hooks: Chain minification with other tools (e.g., composer-normalize) via a custom script.

CI/CD Best Practices

Fail Fast: Add a CI step to validate minified lockfiles:

vendor/bin/composer-metadata-minifier --output=tmp.lock && diff composer.lock tmp.lock || exit 1

Avoid Flaky Lockfiles: Never commit unminified lockfiles to shared branches.

Metadata Minifier Laravel Package