Managing Dependencies

A big part of using Composer is deciding which versions you accept. Most PHP packages follow semantic versioning (semver):

1

MAJOR.MINOR.PATCH     for example  2.10.3

Version constraints

^ is what Composer writes for you with composer require. It is the right default: you get fixes and new features, but not breaking changes.

A tiny constraint checker

This function shows what ^2.10 means.

1
2
3
4
5
6
7
8
9
10
11
12

<?php
function matchesCaret(string $version, string $constraint): bool
{
    [$major, $minor] = array_map("intval", explode(".", ltrim($constraint, "^")));
    [$vMajor, $vMinor] = array_map("intval", explode(".", $version));

    return $vMajor === $major && $vMinor >= $minor;
}

var_dump(matchesCaret("2.10.3", "^2.10"));
var_dump(matchesCaret("2.9.0", "^2.10"));
var_dump(matchesCaret("3.0.0", "^2.10"));

1
2
3

bool(true)
bool(false)
bool(false)

Why constraints matter

• Too loose (*): an update can break your app.
• Too strict (2.10.3): you never get security fixes.
• ^ is the sweet spot.

require vs require-dev

• require: needed in production.
• require-dev: tests, linters, debug bars. Not installed with --no-dev.

Platform requirements

1
2
3
4
5
6
7

{
    "require": {
        "php": "^8.2",
        "ext-json": "*",
        "ext-mbstring": "*"
    }
}

Composer checks that your PHP version and extensions match. The config.platform setting can pretend you have a certain PHP version, which is handy when you develop on a newer PHP than your production server runs.

Inspect your dependencies

1
2
3
4
5

composer show            # all installed packages
composer show --tree     # the dependency tree
composer why vendor/pkg  # why a package is installed
composer outdated        # what could be updated
composer audit           # known security problems

Keeping dependencies healthy

1. Install only what you need. Every package is code you must trust and maintain.
2. Prefer maintained packages. Check release dates and open issues.
3. Update regularly, in small steps.
4. Read changelogs for major versions.
5. Run tests after every update.
6. Run composer audit in your build.

Licences

Each package has a licence (MIT, GPL and so on). For commercial projects, make sure the licences fit how you use the code. composer licenses lists them.