Composer is a...
● Dependency Manager for PHP projects
-> Requirements like frameworks or libraries
● Package Manager for PHP packages
-> Globally installed tools, like Drush or Console
Why should we care?
● Avoiding dependency hell
● Getting off the island
● Don’t reinvent the wheel
● Proudly invented / found elsewhere (PIE)
● Everyone does it
● ~85.000 packages for PHP projects using Composer (2/2016)
-> Specifies requirements, sources and configuration
-> Lists installed dependencies with current versions
-> Dependencies (packages) will be installed here
-> Makes dependencies available to your project
Specify required versions
Composer supported version constraints:
Exact: 7.1.0 -> Exact version
Range: 1.2 - 1.3
Tilde: ~7.1.3 -> Next significant release, >= 7.1.3, < 7.2
Carét: ^7.1.0 -> Next major release, >= 7.1.0, < 8.0.0
One thing to consider
“just edit your composer.json and add…”
"./composer.json" does not contain valid JSON
Warning: The lock file is not up to date with the latest changes
in composer.json. You may be getting outdated dependencies. Run
update to update them.
=> Use composer commands!
Start a new PHP project: composer init
1. Create your index.php: touch index.php
2. Create composer.json: composer init -n
3. Add requirements/dependencies
4. Add the autoloader to your index.php:
Specify requirements: composer require
composer require [ vendor/package ] [ vendor/package ] ...
composer require guzzlehttp/guzzle
composer require phpunit/phpunit --dev
Adds / updates dependencies in composer.json & composer.lock
Package only needed for development? Use --dev !
Install requirements: composer install
composer install --no-dev
Installs exact versions specified in composer.lock
For production environments, use --no-dev !
Update requirements: composer update
composer update [ vendor/package ] [ vendor/package ] ...
Installs the latest version of the specified packages
meeting the requirements in composer.json
Updates composer.lock accordingly
More Composer goodies
● Installs from packagist, various vcs (git, svn, …), pear, zip and more
● Applies patches, if needed
● Supports scripts, e.g. "post-package-install"
● Supports plugins (functional extensions)
Some useful plugins:
composer/installers -> Scaffolding, type-dependent install folders
wikimedia/composer-merge-plugin -> merge multiple composer.json files
fxp/composer-asset-plugin -> manage NPM- / Bower packages (CSS/JS)
Using composer in Drupal projects
Some pitfalls here:
● Semantic versioning: 7.x-3.5, 8.x-4.0 ?
● Different types of packages (modules, themes, libraries)
● Different target folders, not just /vendor
● Dependencies in .info files
● Incompatible project metadata / vcs drupal.org <-> packagist.org
● Specialized package repository, packagist.drupal-composer.org
● Use project templates / skeletons!
Create a new Drupal project using a template
composer create-project drupal-composer/drupal-project:8.x-dev
myproject --stability dev --no-interaction
composer create-project drupal-composer/drupal-project:7.x-dev
myproject -s dev -n
(just a starting point)
This means the dev version of the
template, not of Drupal!
It’s not Drupal, it’s best practice!
composer create-project symfony/framework-standard-edition
composer create-project yiisoft/yii2-app-basic
composer create-project laravel/laravel
Use it for scaffolding, profiles, install scripts, configuration, ...
Managing Drupal Module & Themes
composer require drupal/devel drupal/views
composer update drupal/linkit
composer remove drupal/webform
Composer takes care of dependencies, so e.g.
drupal/views includes drupal/ctools (D7)!
What about custom modules?
"description": "Just a little custom module.",
Optionally (if not using packagist), use composer-merge plugin to merge
your custom composer.json with the main composer.json of your project !
But I use Drush / Console / Bash already?
Great! Keep on using them!
Additionally use them in your Composer scripts!
"drush cc all",
"echo Updates completed!"
Official Composer Documentation
Composer the Right Way
Composer Cheat Sheet for Developers
Drupal Composer community initiative