Skip to main content

Composer

Composer is a dependency manager for PHP. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you.

This template uses Composer to manage dependencies and provide scripts for linting and testing code.

The provided composer.json file contains the following sections:

  • Project Information: Metadata like name, description, and license.

  • Author and Support: Includes maintainer details and URLs for issues and source code.

  • Dependencies: Requires PHP version >= 8.3. If using as base for CLI command, symfony/console is provided as a dependency as well.

  • Development Dependencies: Tools like PHP Code Sniffer, PHPStan, and PHPUnit for development are listed.

  • Auto-loading: PSR-4 standard is used for auto-loading classes from the src directory.

  • Dev Auto-loading: Auto-loads classes for development from tests/phpunit directory.

  • Custom Scripts: Defines CLI scripts for tasks:

    • lint and lint-fix - to lint and fix code using PHP Code Sniffer, PHPStan, and Rector.
    • test - to run PHPUnit tests without generating coverage report.
    • test-coverage - to run PHPUnit tests and generate coverage report.
    • build - to build a PHAR file (if using as base for CLI command).

  • Executable Binaries: Executable binaries are defined as executable scripts in bin directory, which makes them easily accessible without cluttering the global scope.

  • Configuration: Composer is configured with the following settings:

    • Dependency Policy (Composer 2.10+): The policy section sets how Composer treats packages with security advisories and abandoned packages. The template ships these values:

      SettingValueEffect
      advisories.blockfalseComposer installs packages that have known advisories. Set it to true to block them.
      advisories.audit"fail"composer audit fails when an installed package has a known advisory.
      abandoned.audit"report"composer audit lists abandoned packages and still passes.

    Composer older than 2.10 ignores the policy section without a warning. To prevent that, require-dev declares "composer": ">=2.10.2", so an older Composer refuses to install the project. The floor is 2.10.2 because earlier 2.10 releases have a known advisory. The constraint sits in require-dev because config applies only to the root project, so packages that depend on yours keep their own Composer version. composer install --no-dev skips the check, so it applies to composer update and to installs that include development dependencies.

    To allow a specific advisory after you review it, add its ID and your reason to ignore-id:

    "policy": {
      "advisories": {
        "ignore-id": {
          "CVE-2024-1234": "Waiting for upstream fix, mitigated by input validation",
          "GHSA-xxxx-yyyy-zzzz": "False positive - feature not used in our code"
        }
      }
    }

    Remove each exception after a fix is available.

    • Discard Changes: Automatically discards any changes to the composer.lock file that are not committed. This ensures a clean state for the dependency versions defined in composer.json.

    • Sort Packages: Ensures that the packages in composer.json are sorted, which helps in maintaining a consistent and organized structure. Run composer normalize to sort the packages.

    • Minimum Stability: Sets the minimum stability to stable, meaning that only stable versions of packages will be considered when resolving dependencies. You can change this to dev or alpha if you want to include unstable versions in your project.

    • Prefer Stable: Prefers stable versions of packages over unstable ones, providing more reliable and tested packages unless a specific unstable version is required.