PHP Composer¶

ID: composer
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 29,536
Last commit: 2026-09-29
Version requirement: >= 1.4
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup · doctor
purl types: pkg:composer/
CLI name: composer
Every call: composer global --no-ansi <command>
Issues and PRs: 📦 manager: composer
Source: composer.py

Dependency manager for PHP, driven in global mode.

Every operation is prefixed with global so it targets the user-wide Composer project under COMPOSER_HOME ($XDG_CONFIG_HOME/composer on XDG systems, ~/.composer on macOS and other Unixes, %APPDATA%\Composer on Windows) rather than a working tree. installed and outdated parse Composer’s --format=json output, while search reads its plain-text listing; --no-ansi is forced on every call to strip color codes.

What `mpm` adds to `composer`¶

Through mpm, composer gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover composer alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `composer` commands, in `mpm`¶

You already know composer: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `composer`	With `mpm`
List what’s installed	`composer show --format=json`	`mpm --composer installed`
List outdated packages	`composer outdated --format=json`	`mpm --composer outdated`
Search for a package	`composer search --only-name python`	`mpm --composer search python`
Install a package	`composer require illuminate/contracts`	`mpm install pkg:composer/illuminate/contracts`
Upgrade one package	`composer update illuminate/contracts`	`mpm --composer upgrade illuminate/contracts`
Upgrade everything	`composer update`	`mpm --composer upgrade --all`
Remove a package	`composer remove illuminate/contracts`	`mpm remove pkg:composer/illuminate/contracts`
Clear caches	`composer clear-cache`	`mpm --composer cleanup --cache`
Run health checks	`composer diagnose`	`mpm --composer doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅
`orphans`
`search`	✅	Exact search backfilled by `mpm`.
`install`	✅
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`	✅
`doctor`	✅

Configuration¶

Ignore composer on the mpm CLI by passing the --no-composer option.
Ignore it for every run in your configuration:
```
[mpm]
composer = false
```
Raise the timeout of all composer calls:
```
[mpm.overrides.composer]
timeout = 900
```

Run mpm config-template composer to print all overridable settings for your configuration file:

[mpm.overrides.composer]
cli_names = [
    "composer",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "global",
    "--no-ansi",
]
pre_cmds = []
requirement = ">=1.4.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "Composer\\s+version\\s+(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every composer call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around composer, one mpm command each:

Snapshot and clone a machine: mpm --composer dump composer.toml, then mpm restore composer.toml on the next one.
Export a compliance SBOM: mpm --composer sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --composer doctor relays PHP Composer’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of PHP Composer’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed
Mechanism: open PR adds cooldown
Reference: composer/composer#12692

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Packagist (pkg:composer)
Retraction: Index revert: versions are fetched “from tags you create in your VCS repository” (about), so deleting the upstream tag withdraws the version. The package-level abandoned field is flag only (API)
Publish date: ✅ per-version time and published-time (metadata)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know PHP Composer well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ composer global --no-ansi show --format=json
{
  "installed": [
    {
      "name": "carbondate/carbon",
      "version": "1.33.0",
      "description": "A simple API extension for DateTime."
    },
    {
      "name": "guzzlehttp/guzzle",
      "version": "6.3.3",
      "description": "Guzzle is a PHP HTTP client library"
    },
    {
      "name": "guzzlehttp/promises",
      "version": "v1.3.1",
      "description": "Guzzle promises library"
    },
    {
      "name": "guzzlehttp/psr7",
      "version": "1.4.2",
      "description": "PSR-7 message implementation"
    }
  ]
}

$ composer global --no-ansi outdated --format=json
{
    "installed": [
        {
            "name": "illuminate/contracts",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Contracts package."
        },
        {
            "name": "illuminate/support",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Support package."
        }
    ]
}

Version check¶

The version is probed by running:

$ composer --version
Composer version 2.1.8 2021-09-15 13:55:14

and extracted with:

r"Composer\s+version\s+(?P<version>\S+)"

Upstream project¶

Metrics	`composer/composer`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Correct the commands shown on each manager’s page, which named fewer options than mpm actually runs.
6.4.0 (2026-04-27)
- Add remove operation. Closes #1775.
- Fix install operation: use composer global require instead of composer global install.
6.2.0 (2026-03-25)
- Add --no-ansi option to all composer invocations.
- Fix search regex to strip whitespace-only descriptions.
2.8.0 (2019-01-03)
- Add support for PHP composer.