What Composer Is and Why You Need It

Composer is the standard dependency manager for PHP. It lets you pull in third-party libraries (Laravel, Symfony, Guzzle, PHPUnit and thousands of others) with a single command, manage package versions and load every class automatically through the autoloader.

Installing Composer on Ubuntu/Debian

# Download the installer
curl -sS https://getcomposer.org/installer -o /tmp/composer-setup.php

# Verify the hash (the current hash is on getcomposer.org/download)
php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer

# Verify the installation
composer --version

For a global installation (available to all users) put composer in /usr/local/bin/. To install it for the current user only, use ~/.local/bin/.

Updating Composer

composer self-update
# Roll back to the previous version:
composer self-update --rollback

Creating a New Project

# New Laravel project:
composer create-project laravel/laravel myapp

# New Symfony project:
composer create-project symfony/skeleton myapp

Essential Composer Commands

Command	Description
`composer install`	Install dependencies from composer.lock
`composer update`	Update all dependencies to the latest versions
`composer require vendor/package`	Add a new package
`composer remove vendor/package`	Remove a package
`composer dump-autoload -o`	Regenerate the optimized autoloader
`composer show`	List the installed packages

The composer.json Structure

{
    "name": "mycompany/myapp",
    "require": {
        "php": "^8.1",
        "guzzlehttp/guzzle": "^7.0",
        "monolog/monolog": "^3.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^10.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    }
}

Optimizing for Production

On a production server always run Composer with autoloader optimization:

composer install --no-dev --optimize-autoloader --no-interaction
# or
composer dump-autoload --optimize --no-dev

Never run composer update on production — it can break the application by pulling in incompatible versions. Update dependencies locally, commit composer.lock to git and deploy with composer install.

Working Offline (--prefer-dist)

composer install --prefer-dist --no-scripts

Real Composer Errors

Requirements could not be resolved

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires php-ext-intl but it is not present.

Composer checks platform requirements against the PHP it is itself running under (usually the CLI binary), not against whatever is actually running in PHP-FPM in production. Installing the extension for FPM only will not help — Composer keeps refusing until the CLI version sees it too.

Allowed memory size exhausted during install

PHP Fatal error:  Allowed memory size of 1610612736 bytes exhausted (tried to allocate 20480 bytes) in phar:///usr/local/bin/composer/src/Composer/DependencyResolver/Solver.php
Check https://getcomposer.org/doc/articles/troubleshooting.md#memory-limit-errors for more info on how to handle out of memory errors.

Composer itself is a PHP script, and the same memory_limit applies to it as to any other code. Resolving a project with a large dependency tree can require more memory than is allowed by default.

composer.lock is stale

Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run "composer update" or "composer update <package name>".

This is a warning, not a failure: composer install still runs fine against the old composer.lock. The real danger is different — on CI this warning is easy to miss in a stream of log output, and package versions that do not match what was actually tested can end up in production.

When the Commands in This Article Do Not Fit

Development happens without access to packagist.org (a closed network, an air-gapped environment) — a private mirror repository is needed (Satis, Private Packagist); ordinary require commands will just hang waiting for the network.
The Composer CLI and the PHP version in production FPM diverge — the platform check at install time passes, but the code fails in production because of incompatible syntax or a missing function.
The --ignore-platform-reqs flag "fixes" the requirements error but pushes the incompatibility straight to production — use it only deliberately and temporarily.

Verifying the Result

# Get a full diagnostic of the Composer environment
composer diagnose

# Check the syntax and correctness of composer.json
composer validate --strict

# Raise the memory limit for this run only
COMPOSER_MEMORY_LIMIT=-1 composer install

composer validate --strict catches not only JSON syntax errors but also style issues like unpinned dependency versions — it is worth running before every release.