# Use Composer like a Pro - the Dependency Manager for PHP

By Bobby Iliev, 2021-04-21. https://bobbyiliev.com/post/use-composer-like-a-pro-the-dependency-manager-for-php/

# Introduction

Composer is without the go to dependency manager for PHP. Composer is a command line tool that you can use to install packages to your projects and also update and manage existing packages.

If you are coming the JavaScript world you could consider `composer` as the dependency manager for PHP similar to NPM for JavaScript. Or if you have experience with Java, you could make the same analogy with Maven.

You will see an interactive Bash terminal pop up at the bottom of your screen where you can run the composer commands specified in this tutorial.

Composer has a wide variety of open-source packages available at [Packagist](https://packagist.org/).

If you never used composer I would recommend going through this quick article first here: [Composer. Why, What, and How?
](https://devdojo.com/tnylea/composer-why-what-and-how)

In this tutorial you will learn all of the essential composer commands and start using composer like a pro!

# Installation

If you are planning to use the interactive terminal, you can run the following commands to get Composer installed.

As the interactive terminal is based on Ubuntu, we will use `apt` to install PHP first:

* Update your packages:

```execute
apt update -y
```

* Install PHP:

```execute
apt install php*-cli
```

* Download the `composer` installer:

```execute
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
```

* Verify that the installer:

```execute
php -r "if (hash_file('sha384', 'composer-setup.php') === '756890a4488ce9024fc62c56153228907f1545c228516cbf63f885e036d37e9a59d27d63f46af1d4d07ee0f76181c7d3') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
```

* Run the installation:

```execute
php composer-setup.php
```

* Delete the installer:

```
php -r "unlink('composer-setup.php');"
```

* Finally move the `.phar` file to `/usr/bin` so that you could have `composer` in your path and run it from anywhere:

```
mv composer.phar /usr/bin/composer
```

* Verify that it is all working:

```
composer --version
```

Output:

```
Composer version 2.0.12 2021-04-01 10:14:59
```

The above will work on any Ubuntu or Debian based system.

In order to install `composer` on your PC, you can follow the steps from the official documentation:

[https://getcomposer.org/doc/00-intro.md](https://getcomposer.org/doc/00-intro.md)

# Using Composer

Now that we have composer installed, let's go ahead and learn some essential composer commands!

## Adding Composer to a project

If you are starting a new PHP project, you can include Composer by running the following command:

```execute
composer init
```

This command will guide you through creating your `composer.json` config and you will be prompted with a series of questions about your project.

You can follow the prompt and add the necessary information to your project.

At the end you will be prompted with a preview of your `composer.json` file and you can confirm if you want to have it generated.

## Searching for packages

You can search for PHP packages directly via the official Composer package repository here:

* [Packagist](https://packagist.org/)

Instead you could also use the `composer search` command to search for packages directly via your terminal:

```execute
composer search laravel
```

## Installing a composer package

Let's go ahead and install the following `Hello World` package! To do so you can run the following command:

```execute
composer require ehime/hello-world
```

Composer will then download the `ehime/hello-world` package from the Packagist repository to your local machine or the interactive terminal.

You can use the `ls` command to see the content of the current directory:

```execute
ls -lh
```

You will see a directory in there called `vendor` where all of the composer packages will be stored at. To see the content of the Hello World package, run the following command:

```execute
ls -lah vendor/ehime/hello-world/
```

> Note: you should never change the content of the `vendor` folder manually as all of your changes will be lost the next time you run `composer update`. 

If you were now to check the `composer.json` file you will see that under the `require` section, you will see the `hello-world` package listed:

```
    "require": {
        "ehime/hello-world": "^1.0"
    }
```

## The `composer install` command

As we now have the `hello-world` dependency listed in our `composer.json` we can actually completely delete the `vendor` folder and then run `composer install` which will check the `composer.json` file and install all of the required dependecies. Let's give it a try!

* Delete the `vendor` directory:

```execute
rm -r vendor
```

* Verify that the directory is gone:

```execute
ls -lh
```

* Install the dependencies again:

```execute
composer install
```

* Verify that the `vendor` directory is back again:

```execute
ls -lh
```

As you can imgine this is very handy as you can define all of your dependencies in the `composer.json` file, share it with your colleagues and they could just run `composer install` and have all of the dependencies installed.

In most cases the `vendor` directory would not be checked into git as well. 

## Using the installed packages

If you are using a framework like Laravel, the packages will be auto loaded without you having to require the `'vendor/autoload.php'` file.

However if you are not using a framework you could include all of the packages so that you would have all of the classes and functions provided by the packages in your PHP prject, you would need to add the following:

```
<?php  
require 'vendor/autoload.php';
```

So in our cases, if we wanted to use the `SayHello` class for the Hello World package, we could do the following:

```
<?php  
require 'vendor/autoload.php';

use HelloWorld\SayHello;

echo SayHello::world() . "
";
```

Rundown of the file:
* First we require the composer `autoload.php` file which automatically will load all of the packages that we've installed.
* Then we include the SayHello class to our project.
* Finally we use the `world` method from the SayHello class that comes from the package that we've included.

Of course this is a very simple package, but in most cases, you can follow the instructions from the official documentation of each specific package and how to use it.

## Understanding the `composer.lock` file

Thanks to the `composer.lock` file composer would know the exact package verions that should be installed.

In the `composer.lock` file the exact verions of all packages is being recorded including the exact commit ID associated with the package version.

If you were to inspect the `composer.lock` file and search for the `hello-world` package, , you will be able to see all that information:

```
            "name": "ehime/hello-world",
            "version": "1.0.5",
            "source": {
                "type": "git",
                "url": "https://github.com/ehime/hello-world.git",
                "reference": "b1c8cdd2c11272d8c5deec7816e51fa5374217c1"
            },
```

The reference part is the commit ID. That way composer will know the exact versions of the specific packages that should be installed so that your project does not break every time you run `composer install`.

Thanks to the `composer.lock` file you can ensure that all of your team members are running the exact same version of each package. A lock file also gives [dependency scanners](https://devops-daily.com/posts/dependency-scanning-guide) an exact list to check for known vulnerabilities. 

## Updating packages

To get a list of any outdated packages included in your project you can run the following command:

```execute
composer outdated
```

To update the a specific package, you can modify the `composer.json` file and adjust the package version that you want to use. After changing the version, you can run the following command to actually update the packages:

```execute
composer update
```

Composer will then check the `composer.json` file and update the packages that you've increased the version for.

# Useful Composer commands

Here is a short cheatsheet of popular composer commands that you might use on daily basis:

* Initialize a new project:

```
composer init
```

* Install all of the required packages specified in the `composer.json` file:

```
composer install
```

* Installing new packages

```
composer required name_of_package_here
```

* Include package only on your Dev environment by using the `--dev` flag

```
composer require --dev name_of_package_here
```

> Note: This is useful when including packages that could be used for debuging for example

* List all current packages:

```
composer show
```

* Show outdated packages:

```
composer outdated
```

* Update packages:

```
composer update
```

> Note: this will also update your `composer.lock` file

* Removing a package.

```
composer remove package_name_here
```
For more information on how to remove packages, check out this post here:

[How to remove a package from Laravel using composer?](/post/how-to-remove-a-package-from-laravel-using-composer/)

# Conclusion

Hope that this was helpful! As a next step I would recommend going through this video course on how to build a Laravel package which will take your composer knowledge to the next level!

[Creating a Laravel Package](https://devdojo.com/course/create-a-laravel-package)

Also if you are using Git, make sure to exclude the vendor folder from your project. You can do that by following the steps here:

[How to exclude files from your Git project using .gitignore?
](/post/how-to-exclude-files-from-your-git-project-using-gitignore/)