Composer
What Composer is
Composer manages dependencies for PHP projects, installing or updating the libraries a project declares. By default, it places them in a directory within each project, and it can also manage a global project. It supports dependency resolution, lockfiles, workspaces, private registry authentication, and offline installation. Packagist is the default package source; custom Composer, version control, and local path repositories are also supported. Composer integrates with Fossil, Git, Mercurial, Perforce, and Subversion, and runs on Windows, Linux, and macOS. It can be installed locally or system-wide, and the Windows installer sets up PATH for command-line use. The latest version requires PHP 7.2.5 or later; the 2.2.x LTS line supports PHP 5.3.2 and later. The audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. Composer is free and released under the MIT license. Its project warns that plugins and scripts can run with your permissions, so it advises against using Composer as root with untrusted packages.
Who it suits
Composer suits PHP developers who need to install and manage project libraries, including from version control or local repositories. Its offline installation and legacy PHP support may also suit projects with those requirements.
What it does well
- Resolves dependencies and supports lockfiles
- Works with several version control systems
- Supports offline installation
- Audit command checks installed packages
- Free under the MIT license
What to know first
- Latest version requires PHP 7.2.5 or later
- Plugins and scripts can run with your permissions
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Composer | PHP dependency management · MIT license | Free |
As getcomposer.org lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Open https://getcomposer.org/.
- Choose a local project installation or a global executable.
- On Windows, use the installer to install Composer and configure PATH.
- Verify the installer with its SHA-384 hash before running it.
- Run Composer with a PHP version supported by the selected release line.
Verdict
Composer covers dependency installation and updates, with support for several repository types and development workflows. Take care with untrusted packages because plugins and scripts can run with your permissions.
Questions
How much does Composer cost?
Composer is free. The listed plan is free.
Which operating systems does Composer support?
Composer is designed for Windows, Linux, and macOS.
What PHP version does it require?
The latest version requires PHP 7.2.5 or later. The 2.2.x LTS line supports PHP 5.3.2 and later.
Can Composer use private or local package sources?
Yes. Alongside Packagist, it supports custom Composer, version control, and local path repositories, as well as private registry authentication.
Is Composer open source?
Composer and the content on its site are released under the MIT license.
Does Composer offer a security audit?
Yes. The audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies.
Facts from Composer's own pages
- Archive tools
- For decompressing files, Composer relies on tools such as 7z, gzip, tar, unrar, unzip, and xz. · getcomposer.org, 4 Oct 2026
- Containers
- Composer is published as a Docker container, and its documentation shows how to run install against a mounted project directory. · getcomposer.org, 4 Oct 2026
- Dependency resolution
- Composer determines which package versions need to be installed and can update all dependencies in one command. · getcomposer.org, 4 Oct 2026
- Free plan
- Yes · getcomposer.org, 21 Sept 2026
- Installation options
- Composer can be installed locally in a project or globally as a system wide executable. · getcomposer.org, 4 Oct 2026
- Installer verification
- The download instructions verify the installer using its SHA-384 hash before running it. · getcomposer.org, 4 Oct 2026
- Install verification
- The download instructions verify the installer using a SHA-384 hash before running it. · getcomposer.org, 4 Oct 2026
- License
- Composer and the content on its site are released under the MIT license. · getcomposer.org, 4 Oct 2026
- Lockfile support
- Yes · getcomposer.org, 21 Sept 2026
- Offline installation
- Yes · getcomposer.org, 21 Sept 2026
- Package formats
- PHP packages; ZIP; TAR; VCS repositories · getcomposer.org, 21 Sept 2026
- Package sources
- Composer uses Packagist by default and supports custom Composer, VCS, and local path repositories. · getcomposer.org, 4 Oct 2026
- PHP requirement
- The latest Composer version requires PHP 7.2.5 or later. · getcomposer.org, 4 Oct 2026
- PHP requirements
- The latest Composer version requires PHP 7.2.5; the 2.2.x LTS line supports PHP 5.3.2 and later. · getcomposer.org, 4 Oct 2026
- Platforms
- Composer says it is multi-platform and aims to run on Windows, Linux, and macOS. · getcomposer.org, 4 Oct 2026
- Platform support
- Composer says it is designed to run on Windows, Linux, and macOS. · getcomposer.org, 4 Oct 2026
- Private registry auth
- Yes · getcomposer.org, 21 Sept 2026
- Project scope
- Composer installs dependencies in a directory within each project by default, and also supports a global project for convenience. · getcomposer.org, 4 Oct 2026
- Purpose
- Composer is a tool for managing PHP project dependencies, installing and updating the libraries a project declares. · getcomposer.org, 4 Oct 2026
- Release maintenance
- The 2.10.x release line receives bug and security fixes until the next minor release; the 2.2.x LTS line receives critical security fixes through at least 2026-12-31. · getcomposer.org, 4 Oct 2026
- Repository integrations
- Composer supports Fossil, Git, Mercurial, Perforce, and Subversion repositories. · getcomposer.org, 4 Oct 2026
- Security auditing
- The composer audit command checks installed packages for security advisories, abandoned packages, malware flags, and other dependency policies. · getcomposer.org, 4 Oct 2026
- Security caution
- Composer warns that plugins and scripts can execute with the user's permissions and advises against running it as root for untrusted packages. · getcomposer.org, 4 Oct 2026
- Sponsor support
- Silver and Gold sponsors receive a shared Slack channel and priority issue or bug response on GitHub. · getcomposer.org, 4 Oct 2026
Where Composer stands on Freedom251
- Package Managers#6 of 93