PHP Composer
Dependency management, autoloading, lock files, and common commands.
Key PointsCommit `composer.lock`; never commit `vendor/`.
Installing
Bash
# Linux / macOS
curl -sS https://getcomposer.org/installer | php
mv composer.phar /usr/local/bin/composer
# Windows：下载 Composer-Setup.exe
composer --versioncomposer.json
JSON
{
"name": "demo/app",
"description": "示例项目",
"type": "project",
"require": {
"php": ">=8.1",
"monolog/monolog": "^3.0",
"guzzlehttp/guzzle": "^7.8"
},
"require-dev": {
"phpunit/phpunit": "^10.0"
},
"autoload": {
"psr-4": {
"App\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"config": {
"sort-packages": true
},
"scripts": {
"test": "phpunit"
}
}^3.0 means >= 3.0 and < 4.0. ~3.1 means >= 3.1 and < 4.0. 3.1.* means >= 3.1 and < 3.2.
| Constraint | Range |
|---|---|
| ^1.2.3 | >= 1.2.3 < 2.0.0 |
| ~1.2.3 | >= 1.2.3 < 1.3.0 |
| ~1.2 | >= 1.2 < 2.0 |
| 1.2.* | >= 1.2.0 < 1.3.0 |
| >=1.0 <2.0 | 显式区间 |
Common commands
Bash
composer install # 按 lock 文件安装（生产环境用这个）
composer update # 按 json 更新并重写 lock
composer require 包名 # 加依赖
composer remove 包名 # 删依赖
composer dump-autoload # 重建自动加载
composer outdated # 列出可升级的包
composer audit # 检查已知漏洞
composer show 包名 # 查看包信息**Deploy with
composer install, never update.** install follows composer.lock exactly; update may pull incompatible versions.Autoloading
PHP
<?php
require __DIR__ . "/vendor/autoload.php";
use App\Services\Greeter;
$g = new Greeter();
echo $g->hello("Tom"), "\n";
echo class_exists("App\\Services\\Greeter") ? "类已加载" : "类不存在", "\n";App\Services\Greeter maps to src/Services/Greeter.php. That is PSR-4: prefix to directory, remainder to path.
Output
你好，Tom
类已加载Lock file and deployment
| File | Commit | Why |
|---|---|---|
| composer.json | 是 | 依赖声明 |
| composer.lock | 是 | 锁定确切版本，保证环境一致 |
| vendor/ | 否 | 体积大，可随时重建 |
| .env | 否 | 含密钥 |
Library packages should not commit
composer.lock — they must test against many versions. Applications must commit it.Production
Bash
composer install --no-dev --optimize-autoloader --no-interaction
# --no-dev 不装 require-dev
# --optimize-autoloader 生成 classmap，加载更快
# --no-interaction 不询问，适合 CI--optimize-autoloader (-o) bakes a class-to-file map, skipping runtime path resolution. Always use it in production.
Private repositories
JSON
{
"repositories": [
{
"type": "vcs",
"url": "git@github.com:myorg/private-package.git"
}
],
"config": {
"github-oauth": {
"github.com": "ghp_xxxxxxxx"
}
}
}**Never put tokens in
composer.json** — it lands in Git. Use composer config --global or the COMPOSER_AUTH environment variable.Troubleshooting
| Problem | Fix |
|---|---|
| 内存不足 | COMPOSER_MEMORY_LIMIT=-1 composer update |
| 版本冲突 | 看 composer why-not 包 版本 |
| 国内下载慢 | 配镜像：composer config -g repo.packagist composer https://mirrors.aliyun.com/composer/ |
| class not found | composer dump-autoload 重建 |
| lock 与 json 不一致 | composer update --lock |
安装
Bash
# Linux / macOS
curl -sS https://getcomposer.org/installer | php
mv composer.phar /usr/local/bin/composer
# Windows：下载 Composer-Setup.exe
composer --versioncomposer.json
JSON
{
"name": "demo/app",
"description": "示例项目",
"type": "project",
"require": {
"php": ">=8.1",
"monolog/monolog": "^3.0",
"guzzlehttp/guzzle": "^7.8"
},
"require-dev": {
"phpunit/phpunit": "^10.0"
},
"autoload": {
"psr-4": {
"App\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"config": {
"sort-packages": true
},
"scripts": {
"test": "phpunit"
}
}^3.0 表示「>= 3.0 且 < 4.0」。~3.1 表示「>= 3.1 且 < 4.0」。3.1.* 表示「>= 3.1 且 < 3.2」。
| 约束 | 范围 |
|---|---|
| ^1.2.3 | >= 1.2.3 < 2.0.0 |
| ~1.2.3 | >= 1.2.3 < 1.3.0 |
| ~1.2 | >= 1.2 < 2.0 |
| 1.2.* | >= 1.2.0 < 1.3.0 |
| >=1.0 <2.0 | 显式区间 |
常用命令
Bash
composer install # 按 lock 文件安装（生产环境用这个）
composer update # 按 json 更新并重写 lock
composer require 包名 # 加依赖
composer remove 包名 # 删依赖
composer dump-autoload # 重建自动加载
composer outdated # 列出可升级的包
composer audit # 检查已知漏洞
composer show 包名 # 查看包信息**部署时用
composer install，不要用 update。** install 严格按 composer.lock 装同一版本；update 会升到新版本，可能引入不兼容变更。自动加载
PHP
<?php
require __DIR__ . "/vendor/autoload.php";
use App\Services\Greeter;
$g = new Greeter();
echo $g->hello("Tom"), "\n";
echo class_exists("App\\Services\\Greeter") ? "类已加载" : "类不存在", "\n";App\Services\Greeter 对应 src/Services/Greeter.php。这是 PSR-4 的规则：命名空间前缀映射目录，剩余部分映射路径。
Output
你好，Tom
类已加载锁文件与部署
| 文件 | 是否提交 | 原因 |
|---|---|---|
| composer.json | 是 | 依赖声明 |
| composer.lock | 是 | 锁定确切版本，保证环境一致 |
| vendor/ | 否 | 体积大，可随时重建 |
| .env | 否 | 含密钥 |
库项目（被别人依赖的包）**不该提交
composer.lock**，因为要测试与各种版本的兼容性。应用项目必须提交。生产环境
Bash
composer install --no-dev --optimize-autoloader --no-interaction
# --no-dev 不装 require-dev
# --optimize-autoloader 生成 classmap，加载更快
# --no-interaction 不询问，适合 CI--optimize-autoloader（简写 -o）会把类名到文件的映射固化成一张表，省掉运行时的路径推导。上线必开。
私有仓库
JSON
{
"repositories": [
{
"type": "vcs",
"url": "git@github.com:myorg/private-package.git"
}
],
"config": {
"github-oauth": {
"github.com": "ghp_xxxxxxxx"
}
}
}token **不要写进
composer.json**（会进 Git）。用 composer config --global github-oauth.github.com <token> 写到全局配置，或者用环境变量 COMPOSER_AUTH。常见问题
| 问题 | 解决 |
|---|---|
| 内存不足 | COMPOSER_MEMORY_LIMIT=-1 composer update |
| 版本冲突 | 看 composer why-not 包 版本 |
| 国内下载慢 | 配镜像：composer config -g repo.packagist composer https://mirrors.aliyun.com/composer/ |
| class not found | composer dump-autoload 重建 |
| lock 与 json 不一致 | composer update --lock |