Search by

Latest News

Announcing the Composer & Packagist Sponsorship Program - Jul 30, 2026

Today we are launching a formal sponsorship program for Composer and Packagist.org, together with new public sponsor pages on packagist.org/sponsor and getcomposer.org/sponsor. We want to start by thanking the companies who are on board at launch: Pr...

Immutable Versions on Packagist - Jul 07, 2026

This is the next post in our supply chain security series, following the supply chain security update and the Composer 2.10 release. Each post in this series covers a specific behavior worth understanding, and a change we are making on top of it. Tod...

Composer 2.10 Release - May 28, 2026

We are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of security advisories, abandoned packages, and now mal...

An update on Composer & Packagist supply chain security - May 27, 2026

The last months, and even more so the last weeks, saw an increasing amount of software supply chain attacks targeting open-source ecosystems. A handful of these have hit the PHP ecosystem too, via taken-over GitHub accounts and stolen access tokens t...

Composer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messages - May 13, 2026

Please immediately update Composer to version 2.9.8 or 2.2.28 (LTS) by running composer.phar self-update. The new releases fix a vulnerability where Composer leaks the full contents of GitHub Actions issued GITHUB_TOKENs or GitHub App installation to...

Installing PHP Dependencies

Define Your Dependencies

Put a file named composer.json at the root of your project, containing your project dependencies:

{
    "require": {
        "vendor/package": "1.3.2",
        "vendor/package2": "1.*",
        "vendor/package3": "^2.0.3"
    }
}

For more information about package versions usage, see the Composer documentation.

Install Composer and Dependencies

Run this in your project root:

curl -sS https://getcomposer.org/installer | php
php composer.phar install

Or download composer.phar into your project root. See the Composer documentation for complete installation instructions on various platforms.

Autoload Dependencies

Add a require 'vendor/autoload.php'; to your code to make all dependencies autoloadable and available to your code at runtime. Browse the packages we have to find more great libraries you can use in your project.

Publishing Packages

Define Your Package

Put a file named composer.json at the root of your package's repository, containing this information:

{
    "name": "your-vendor-name/package-name",
    "description": "A short description of what your package does",
    "require": {
        "php": ">=8.2",
        "another-vendor/package": "1.*"
    }
}

This is the strictly minimal information you have to give.

Publish It

Run composer validate to check the file for syntax errors and commit it to your repository. Then log in or register and hit the submit button in the menu to enter your public repository URL. Your package will then be crawled periodically, so all you have to do is keep the composer.json file up to date.

See the about page for the full guide, including how to name your package and how to share private code.