How to Use Composer for PHP Package Management

Composer is the dependency manager for PHP that has now become a required standard in modern PHP development. Almost all popular PHP frameworks — Laravel, Symfony, Slim, CodeIgniter 4 — use Composer to manage packages and dependencies. With Composer, you no longer need to download libraries manually and set up autoloading yourself. It's all handled automatically with just a few terminal commands.

Installing Composer

Make sure PHP is installed on your system, then download and install Composer:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
php -r "unlink('composer-setup.php');"
mv composer.phar /usr/local/bin/composer

For Windows, download the installer from https://getcomposer.org. Verify a successful installation with:

composer --version

Starting a New Project with Composer

Initialize Composer in your project folder:

composer init

An interactive wizard will guide you through filling in the project name, description, and more. The result is a composer.json file — Composer's main configuration file.

Or you can install a framework directly all at once:

composer create-project laravel/laravel project-name

Adding Packages with composer require

To add a library/package to your project:

composer require guzzlehttp/guzzle
composer require monolog/monolog
composer require vlucas/phpdotenv

Composer will download the package along with all its dependencies, store them in the vendor/ folder, and record their versions in composer.json and composer.lock.

To add a package needed only during development (for example testing):

composer require --dev phpunit/phpunit

Understanding composer.json

The composer.json file contains the list of dependencies and project configuration:

{
  "name": "username/my-project",
  "require": {
    "php": ">=8.0",
    "guzzlehttp/guzzle": "^7.0",
    "monolog/monolog": "^3.0"
  },
  "require-dev": {
    "phpunit/phpunit": "^10.0"
  },
  "autoload": {
    "psr-4": {
      "App\\": "src/"
    }
  }
}

Installing Dependencies from composer.json

When you clone someone else's project or just pulled from Git, run:

composer install

This command downloads all the packages listed in composer.json according to the versions locked in composer.lock.

To update all packages to the latest compatible versions:

composer update

Autoloading with Composer

One of Composer's best features is autoloading. Add the configuration to composer.json:

{
  "autoload": {
    "psr-4": {
      "App\\": "src/"
    }
  }
}

After that, run:

composer dump-autoload

Now in your PHP file, just add one line and all classes will load automatically:

<?php
require 'vendor/autoload.php';

use App\Models\User;

$user = new User();

Frequently Used Composer Commands

• composer install — Install all dependencies from composer.lock.
• composer update — Update dependencies to the latest compatible versions.
• composer require name/package — Add a new package.
• composer remove name/package — Remove a package.
• composer show — Show the list of installed packages.
• composer outdated — Show packages that already have newer versions.
• composer dump-autoload — Regenerate the autoload file.

Files You Shouldn't Commit to Git

Add the following line to .gitignore so the vendor folder isn't committed (its size can be very large):

vendor/

However, composer.json and composer.lock must be committed so that all team members use identical package versions.

Conclusion

Composer is a tool inseparable from modern PHP development. By understanding how to install, add packages, and take advantage of autoloading, you're already able to manage PHP project dependencies professionally. Always commit the composer.json and composer.lock files, ignore the vendor folder, and use composer install when starting on a new machine. With this habit, team collaboration becomes more consistent and easy to manage.