PHP Composer¶

Dependency manager for PHP, driven in global mode.

Every operation is prefixed with global so it targets the user-wide Composer project under COMPOSER_HOME ($XDG_CONFIG_HOME/composer on XDG systems, ~/.composer on macOS and other Unixes, %APPDATA%\Composer on Windows) rather than a working tree. installed and outdated parse Composer’s --format=json output, while search reads its plain-text listing; --no-ansi is forced on every call to strip color codes.

Home page: https://getcomposer.org
Source: meta_package_manager/managers/composer.py
Version requirement: >=1.4.0

Platforms¶

🅱️ BSD
🐧 Linux
🍎 macOS
⨂ Unix
🪟 Windows

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`search`	✓	exact search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`	✓

Ecosystem¶

Accepted purl types: pkg:composer

Usage¶

$ mpm --composer installed
$ mpm --composer search "query"
$ mpm --composer upgrade --all
$ mpm install pkg:composer/hello
$ mpm --dry-run --composer upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-composer, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line¶

CLI names, in lookup order: composer
Arguments forced before each call: global --no-ansi

The version is probed by running:

$ composer --version
Composer version 2.1.8 2021-09-15 13:55:14

and extracted with:

r"Composer\s+version\s+(?P<version>\S+)"

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of PHP Composer’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed
Mechanism: open PR adds cooldown
Reference: composer/composer#12692

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know PHP Composer well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ composer global show --format=json
{
  "installed": [
    {
      "name": "carbondate/carbon",
      "version": "1.33.0",
      "description": "A simple API extension for DateTime."
    },
    {
      "name": "guzzlehttp/guzzle",
      "version": "6.3.3",
      "description": "Guzzle is a PHP HTTP client library"
    },
    {
      "name": "guzzlehttp/promises",
      "version": "v1.3.1",
      "description": "Guzzle promises library"
    },
    {
      "name": "guzzlehttp/psr7",
      "version": "1.4.2",
      "description": "PSR-7 message implementation"
    }
  ]
}

$ composer global outdated --format=json
{
    "installed": [
        {
            "name": "illuminate/contracts",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Contracts package."
        },
        {
            "name": "illuminate/support",
            "version": "v5.7.2",
            "latest": "v5.7.3",
            "latest-status": "semver-safe-update",
            "description": "The Illuminate Support package."
        }
    ]
}