Weave Code
Composer Normalize Laravel Package
ergebnis/composer-normalize
A Composer plugin that normalizes composer.json, sorting and formatting it consistently so contributors don't argue over style. Install it as a dev dependency, allow the plugin, and run it locally or in CI to keep JSON clean and reduce merge conflicts.
ergebnis/composer-normalize is a Composer plugin that normalizes composer.json, so teams don’t have to manually enforce formatting or argue over contributor changes. It applies consistent ordering and formatting, keeping dependency manifests clean, readable, and review-friendly.
- Automatic normalization through the
composer normalizecommand - Consistent key ordering and formatting for clearer diffs
- Composer plugin integration with simple dev installation
- Dry-run checks to verify normalization without modifying files
- Less formatting noise in pull requests and code reviews
Frequently asked questions about Composer Normalize
- How do I install ergebnis/composer-normalize in a Laravel project?
- Install it as a dev dependency with composer require --dev ergebnis/composer-normalize, then allow the plugin with composer config allow-plugins.ergebnis/composer-normalize true. Laravel projects already using Composer 2.x need no application code changes. After that, run composer normalize to clean up composer.json locally or in CI.
- Why does Composer ask me to allow the ergebnis/composer-normalize plugin?
- Composer 2 blocks plugins unless they are explicitly allowed for security. Add allow-plugins.ergebnis/composer-normalize true to composer.json or run the composer config command. Restrict this to trusted development environments because plugins can execute code.
- Is ergebnis/composer-normalize compatible with Laravel 10, 11, and 12?
- It is not Laravel-specific and works anywhere Composer 2.x is available, so Laravel 10, 11, and 12 projects can use it. Version 2.54.0 explicitly allows installation on PHP 8.6, and there is no upper PHP bound noted. Check your project's Composer version because the package requires Composer 2.0 or newer.
- How do I enforce composer.json normalization in Laravel CI?
- Run composer normalize --dry-run in your GitHub Actions, GitLab CI, or other pipeline step and fail the build when it reports changes. This validates formatting without rewriting files during CI. You can also use the dry-run or diff output to show contributors exactly what needs normalizing.
- Will running composer normalize modify my composer.lock file?
- It can update composer.lock when normalization changes composer.json in a way that affects dependency metadata. In CI validation, use composer normalize --dry-run or --no-update-lock to avoid unintended lock file changes. Review lock file diffs before committing normalized manifests.
- How should I use composer-normalize in a Laravel monorepo with multiple packages?
- Run normalization against each composer.json that you want to standardize, including the root manifest and any sub-package manifests. Add composer normalize to scripts or CI matrix jobs so every package gets checked consistently. Use the extra.composer-normalize configuration when a package needs different rules.
- Can I use ergebnis/composer-normalize alongside Laravel Pint?
- Yes, the two tools solve different problems: Pint formats PHP source code while composer-normalize formats composer.json. They can run in the same local hook or CI pipeline without conflict. This gives Laravel projects consistent PHP style and consistent dependency manifests.
- What are alternatives to ergebnis/composer-normalize?
- The main alternatives are formatting composer.json manually, accepting inconsistent formatting, or using custom scripts to reorder keys. ergebnis/composer-normalize is purpose-built for Composer manifest normalization and integrates as a plugin. For most Laravel teams it is simpler than maintaining bespoke formatting rules.
- Is ergebnis/composer-normalize safe to install in a Laravel application?
- Install it as a dev dependency so it is not part of production runtime code. It operates as a Composer plugin and only affects manifests when you run its commands or hooks. You should still allow the plugin explicitly and audit plugin permissions in restricted environments.
- How actively maintained is ergebnis/composer-normalize and what version should I pin?
- Recent releases from 2.51.0 through 2.54.0 are maintenance and CI hardening updates with no relevant public API changes for Laravel consumers. The project has a stable release cadence and explicitly supports newer PHP versions such as PHP 8.6. Pinning to ^2.54 is reasonable, or allow newer minor releases if you trust the maintenance cadence.
Weaver
How can I help you explore Laravel packages today?