PHP Composer¶

ID: composer
Home page: https://getcomposer.org
Version requirement: >= 1.4
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup · doctor
purl types: pkg:composer
CLI name: composer
Every call: composer global --no-ansi <command>
Issues and PRs: 📦 manager: composer
Source: meta_package_manager/managers/composer.py

Dependency manager for PHP, driven in global mode.

Every operation is prefixed with global so it targets the user-wide Composer project under COMPOSER_HOME ($XDG_CONFIG_HOME/composer on XDG systems, ~/.composer on macOS and other Unixes, %APPDATA%\Composer on Windows) rather than a working tree. installed and outdated parse Composer’s --format=json output, while search reads its plain-text listing; --no-ansi is forced on every call to strip color codes.

What `mpm` adds to `composer`¶

Through mpm, composer gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover composer alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `composer` commands, in `mpm`¶

You already know composer: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `composer`	With `mpm`
List what’s installed	`composer show --format=json`	`mpm --composer installed`
List outdated packages	`composer outdated --format=json`	`mpm --composer outdated`
Search for a package	`composer search symfony`	`mpm --composer search symfony`
Install a package	`composer require illuminate/contracts`	`mpm install pkg:composer/illuminate/contracts`
Upgrade one package	`composer update illuminate/contracts`	`mpm --composer upgrade illuminate/contracts`
Upgrade everything	`composer update`	`mpm --composer upgrade --all`
Remove a package	`composer remove illuminate/contracts`	`mpm remove pkg:composer/illuminate/contracts`
Clear caches	`composer clear-cache`	`mpm --composer cleanup --cache`
Run health checks	`composer diagnose`	`mpm --composer doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`	✓
`doctor`	✓

Selecting and configuring `composer`¶

Deselect composer for a single run with --no-composer, or persist the choice in your configuration:

[mpm]
composer = false

The arguments and environment variables listed in the box atop this page are forced on every composer call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.composer]
timeout = 900

mpm config-template composer prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around composer, one mpm command each:

Snapshot and clone a machine: mpm --composer dump composer.toml, then mpm restore composer.toml on the next one.
Export a compliance SBOM: mpm --composer sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --composer doctor relays PHP Composer’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of PHP Composer’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed
Mechanism: open PR adds cooldown
Reference: composer/composer#12692

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Packagist (pkg:composer)
Retraction: Index revert: versions are fetched “from tags you create in your VCS repository” (about), so deleting the upstream tag withdraws the version. The package-level abandoned field is flag only (API)
Publish date: ✅ per-version time and published-time (metadata)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ composer --version
Composer version 2.1.8 2021-09-15 13:55:14

and extracted with:

r"Composer\s+version\s+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know PHP Composer well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ composer global show --format=json
{
  "installed": [
    {
      "name": "carbondate/carbon",
      "version": "1.33.0",
      "description": "A simple API extension for DateTime."
    },
    {
      "name": "guzzlehttp/guzzle",
      "version": "6.3.3",
      "description": "Guzzle is a PHP HTTP client library"
    },
    {
      "name": "guzzlehttp/promises",
      "version": "v1.3.1",
      "description": "Guzzle promises library"
    },
    {
      "name": "guzzlehttp/psr7",
      "version": "1.4.2",
      "description": "PSR-7 message implementation"
    }
  ]
}

$ composer global outdated --format=json
{
    "installed": [
        {
            "name": "illuminate/contracts",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Contracts package."
        },
        {
            "name": "illuminate/support",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Support package."
        }
    ]
}

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --composer installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

6.4.0 (2026-04-27)
- Add remove operation. Closes #1775.
- Fix install operation: use composer global require instead of composer global install.
6.2.0 (2026-03-25)
- Add --no-ansi option to all composer invocations.
- Fix search regex to strip whitespace-only descriptions.
2.8.0 (2019-01-03)
- Add support for PHP composer.