What Is PHP Composer? Dependency Management Explained

Most PHP projects use code written by other people: a library to send email, one to parse Markdown, one to talk to a payment service. That code is called a package or library. Your project depends on it, so it is a dependency.

Composer is the tool that manages those dependencies. It downloads them, keeps them at the right versions, and sets up autoloading so you can use them straight away.

Without Composer, you would download ZIP files by hand, copy them into your project, write require lines, and track every update yourself. Composer does all of that with a few commands.

The pieces

Name	What it is
Composer	The command-line tool
Packagist	The main public catalogue of PHP packages at packagist.org
composer.json	Your list of requirements and settings
composer.lock	The exact versions that were installed
vendor/	The folder where Composer puts the downloaded code
vendor/autoload.php	One file that loads every package (and your own classes)

What a day with Composer looks like

terminal

BASH

composer require league/commonmark   # add a package

index.php

PHP

<?php
require __DIR__ . "/vendor/autoload.php";   // one line loads everything

use League\CommonMark\CommonMarkConverter;

echo (new CommonMarkConverter())->convert("# Hello");

That is the whole idea: ask for a package, then use it.

Dependencies have dependencies

A package can need other packages. Composer works out the whole tree. When you install one package, you may get several others, all at versions that work together. That is why tracking them by hand is painful.

Why Composer matters

Everyone uses it. Laravel, Symfony and modern WordPress tools (Bedrock, WP-CLI packages) are installed with Composer.
Repeatable installs. A teammate or a server can recreate the exact same set of packages from two files.
Autoloading. No require lists.
Updates and security. One command shows outdated and vulnerable packages.

What Composer is not

It is not a package you run on a web page. It runs in the terminal, on your computer or on your server during deployment.
It does not replace understanding the code you install. Every dependency is code that runs on your server, so choose them with care.

npm does the same job for JavaScript.
pip does it for Python.

info

Why this matters in Laravel

A new Laravel project is created with composer create-project laravel/laravel my-app. Laravel itself is a set of Composer packages, and everything you add to it comes through composer require.