Introduction to Composer [Command-line interface]
Coding (Php 7.x)
Learn about composer init, install, update, require, search and many other command you can use while writing PHP

Introduction
As a PHP developer, you surely have already realized that one of the most powerful tools in your toolset is the command line.
While I agree that spending time on the IDE of your choice and write code is the most beautiful task, I cannot deny the fact that several tools still use the terminal as the primary way to interact with them.
This old-style black and white window, in fact, hide treasures that let you work fast and in a more efficient way.
A clear example of this is Composer.
Composer, with its library of more than 30 commands, rely completely on the command-line interface (CLI for friends).
In this post, we are going to look at all of them and I’ll provide an explanation of what they do and how you can use them most efficiently.
How to read this article
This is not a typical blog post.
In here you will see all the commands included in the Composer library, some are very common and are being used multiple time a day other is used only in specific cases.
Also, there will be no job interview in which they will ask you what the command composer why -tnv does.
The way you need to look at this post is to read through it and discover what command you might use, then come here again every now and then to check if there are any commands you can implement in your working routine.
About this series
This article is part of the series Introduction to Composer,
If you haven't read the previous part already head to
- Installation and components,
- Command-line interface
- Command-line interface part 2
- Destructuring composer.json
- Repositories
The Commands
Working with Composer is not difficult at all,
You will see that on a daily basis you are going to use almost always the same 5 or 6 commands that, after a bit, will become second nature.
It is important though, to know that there are a dozen other commands outside of our comfort zone, and it is good to know that they exist and what they do.
The most basic command you can think of is the command composer, it just lists all the command available through the Composer tool.
You can achieve the same effect by using the command
composer list
Global Options
Composer provides some flags that are available for every command in this list.
These flags are available for a multitude of command, in this list, you can see a detailed explanation of the majority of them.
Then in the list of commands below, you will be able to understand if a flag is usable or not for that given command
The most popular flags are:
--verbose (-v)
Increase the verbosity of messages.
You can add up to 3 v-es, 1 for normal output, 2 for more verbose output and 3 for debug
--help (-h)
This command shows more information regarding the command you have just typed.
It is normally used as a suffix.
--quiet (-q)
It hides any message from the command line
--no-interaction (-n)
Sometimes Composer may ask you question such as confirming that you want to do an action or setting the permission of a folder.
By adding the -n flag at the end of the command this behaviour will be suppressed, what it does is to trigger Composer to pick the default option whenever an interactive action is necessary:
--no-plugins
In Composer you can create or remove plugins that are indicated in the composer.json file.
Using this flag you make sure that no plugins will be considered
--no-cache
Located on C:\Users\
When this command is used it disables the use of the cache directory.
You can achieve the same result by setting the COMPOSER_CACHE_DIR env var to /dev/null (or NUL on Windows).
--working-dir (-d)
Let’s say I am working on the patch /home/Nico and I want to install composer on a folder inside the previous directory.
What I normally do is to go inside the folder I want to run the command and go back.
This flag allows us to stay in our current position and installing Composer or doing all the work we want to do anyway.
Here is how we do so:
composer install -d=/home/Nico/myproject
--profile
This flag attaches the timing required to perform the command and the current memory usage information.
--ansi:
ANSI output is a standard that controls the cursor location, colour, and a few other options on video text terminals and terminal emulators.
By default, Composer uses ANSI for example by running composer you should see the list of command highlight from the explanation on the right and side
--no-ansi
if you add this flag to a Composer command it disables the ANSI standard output, colour and a few syntaxes will disappear
--version (-V)
this is straight forward, it displays the version of the composer you are running currently.
composer init [options]
The init command creates a basic composer.json file in the current directory.
It basically makes your project become an anonymous component.
With this command you can use several options, they are listed below
- --name=NAME Name of the package
- --description=DESCRIPTION Description of package
- --author=AUTHOR Author name of the package
- --type[=TYPE] Type of package (e.g. library, project, metapackage, composer-plugin)
- --homepage=HOMEPAGE Homepage of package
- --require=REQUIRE Package to require with a version constraint, e.g. foo/bar:1.0.0 or foo/bar=1.0.0 or "foo/bar 1.0.0" (multiple values allowed)
- --require-dev=REQUIRE-DEV Package to require for development with a version constraint, e.g. foo/bar:1.0.0 or foo/bar=1.0.0 or "foo/bar 1.0.0" (multiple values allowed)
- -s, --stability=STABILITY Minimum stability (empty or one of: stable, RC, beta, alpha, dev)
- -l, --license=LICENSE License of package
- --repository=REPOSITORY Add custom repositories, either by URL or using JSON arrays (multiple values allowed)
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer install [options] [--] []
After the composer.json has been created the install command reads the composer.lock file from the directory selected.
It downloads and installs all the libraries and dependencies outlined in the file.
If the file does not exist it will look for composer.json and do the same.
Daniel Pataki wrote about this command and how to use on his guide on phpnewspot
Here is the list of options available for this command:
- --prefer-source Forces installation from package sources when possible, including VCS information.
- --prefer-dist Forces installation from package dist even for dev versions.
- --dry-run Outputs the operations but will not execute anything (implicitly enables --verbose).
- --dev Enables installation of require-dev packages (enabled by default, only present for BC).
- --no-dev Disables the installation of require-dev packages.
- --no-custom-installers DEPRECATED: Use no-plugins instead.
- --no-autoloader Skips autoloader generation
- --no-scripts Skips the execution of all scripts defined in composer.json file.
- --no-progress Do not output download progress.
- --no-suggest Do not show package suggestions.
- -o, --optimize-autoloader Optimize autoloader during autoloader dump
- -a, --classmap-authoritative Autoload classes from the classmap only. Implicitly enables `--optimize-autoloader`.
- --apcu-autoloader Use APCu to cache found/not-found classes.
- --ignore-platform-reqs Ignore platform requirements (php & ext- packages).
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer update,
composer update vendor/package1 foo/mypackage [...],
composer update vendor/package1 foo/* [...]
The update command reads the composer.json file from the selected directory and updates, removes or installs all the dependencies.
There are a few versions of this command.
For instance, you can use the second version shown above to limit the update operation to a few packages, you can list the package(s) you want to update as such:
You can also use an asterisk (*) pattern to limit the update operation to package(s) from a specific vendor.
Eventually to select packages names interactively with auto-completion use -i.
Here are the flags:
- --prefer-source Forces installation from package sources when possible, including VCS information.
- --prefer-dist Forces installation from package dist even for dev versions.
- --dry-run Outputs the operations but will not execute anything (implicitly enables --verbose).
- --dev Enables installation of require-dev packages (enabled by default, only present for BC).
- --no-dev Disables the installation of require-dev packages.
- --lock Only updates the lock file hash to suppress warning about the lock file being out of date.
- --no-custom-installers DEPRECATED: Use no-plugins instead.
- --no-autoloader Skips autoloader generation
- --no-scripts Skips the execution of all scripts defined in composer.json file.
- --no-progress Do not output download progress.
- --no-suggest Do not show package suggestions.
- --with-dependencies Add also dependencies of allowed packages to the allow list, except those defined in root package.
- --with-all-dependencies Add also all dependencies of allowed packages to the allow list, including those defined in root package.
- -o, --optimize-autoloader Optimize autoloader during autoloader dump.
- -a, --classmap-authoritative Autoload classes from the classmap only. Implicitly enables `--optimize-autoloader`.
- --apcu-autoloader Use APCu to cache found/not-found classes.
- --ignore-platform-reqs Ignore platform requirements (php & ext- packages).
- --prefer-stable Prefer stable versions of dependencies.
- --prefer-lowest Prefer lowest versions of dependencies.
- -i, --interactive Interactive interface with autocompletion to select the packages to update.
- --root-reqs Restricts the update to your first degree dependencies.
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
Composer require [options] [--] []
If your application needs a new package the require command is what you are looking for.
composer requires adds required packages to your composer.json and installs them.
Generally, you want to use this command and specify what package you want to install.
If instead, you do not want to specify any package, Composer will prompt you to search for a package then it will provide a list of matches to require.
Regarding the package version, if it is not specified, what Composer will do is to choose a suitable one based on the available package versions.
And important flag available for this command is the --no-update flag.
You can use it in case you do not want to install the new dependencies immediately.
The other flags are:
- --dev Add requirement to require-dev.
- --prefer-source Forces installation from package sources when possible, including VCS information.
- --prefer-dist Forces installation from package dist even for dev versions.
- --fixed Write fixed version to the composer.json.
- --no-progress Do not output download progress.
- --no-suggest Do not show package suggestions.
- --no-update Disables the automatic update of the dependencies.
- --no-scripts Skips the execution of all scripts defined in composer.json file.
- --update-no-dev Run the dependency update with the --no-dev option.
- --update-with-dependencies Allows inherited dependencies to be updated, except those that are root requirements.
- --update-with-all-dependencies Allows all inherited dependencies to be updated, including those that are root requirements.
- --ignore-platform-reqs Ignore platform requirements (php & ext- packages).
- --prefer-stable Prefer stable versions of dependencies.
- --prefer-lowest Prefer lowest versions of dependencies.
- --sort-packages Sorts packages when adding/updating a new dependency
- -o, --optimize-autoloader Optimize autoloader during autoloader dump
- -a, --classmap-authoritative Autoload classes from the classmap only. Implicitly enables `--optimize-autoloader`.
- --apcu-autoloader Use APCu to cache found/not-found classes.
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer remove [options] [--] ()
As you might have already understood the composer remove command removes the package you indicated from the current list of installed packages.
You can also remove more than a package at once by listing them one after another.
This and other commands are available on the cheat sheet developed by the guys over devhints.io
This command has several options as well and they are:
- --dev Removes a package from the require-dev section.
- --no-progress Do not output download progress.
- --no-update Disables the automatic update of the dependencies.
- --no-scripts Skips the execution of all scripts defined in composer.json file.
- --update-no-dev Run the dependency update with the --no-dev option.
- --update-with-dependencies Allows inherited dependencies to be updated with explicit dependencies. (Deprecated, is now default behaviour)
- --no-update-with-dependencies Does not allow inherited dependencies to be updated with explicit dependencies.
- --ignore-platform-reqs Ignore platform requirements (php & ext- packages).
- -o, --optimize-autoloader Optimize autoloader during autoloader dump
- -a, --classmap-authoritative Autoload classes from the classmap only. Implicitly enables `--optimize-autoloader`.
- --apcu-autoloader Use APCu to cache found/not-found classes.
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer check-platform-reqs [options]
This command verifies that your version of PHP and its extensions versions match the platform requirements of the installed packages.
It will return a table containing the extensions, its version and a success or failure bool.
Unlike the command composer update and composer install, composer check-platform-reqs ignores the settings inside config.platform and check the real platform packages.
It does it so you can be certain you have the required platform dependencies.
Its flags are:
- --no-dev Disables checking of require-dev packages requirements.
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer global []
Little preface:
Composer has several environmental variables.
One of these is COMPOSER_HOME.
it allows you to change the Composer home directory.
This is a hidden, global (per-user on the machine) directory that is shared between all projects.
It points to C:\Users\
composer global is used as a wrapper to run other Composer commands within the global context of COMPOSER_HOME.
More information are available on the official documentation
You can use this command to install CLI utilities globally, all you need is to add the COMPOSER_HOME/vendor/bin dir to your PATH environmental variable.
Of course, pay attention to the fact that this path can change depending on your machine customizations to bin-dir in composer.json or the environmental variable COMPOSER_BIN_DIR.
composer search [options] [--] ()
This is quite a straightforward command
The search command simply searches for packages by its name.
It returns a list of packages with the format vendor/name and a little description of the relative package.
composer search’s flags are:
- -N, --only-name Search only in name
- -t, --type=TYPE Search for a specific package type
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer show [options] [--] [] []
composer info [options] [--] [] []
The composer show and the composer info commands display detailed information about one or more packages that have been indicated in the command;
You can specify both package and the version you need more details about.
The flag for these two commands are the same and are:
- --all List all packages
- -i, --installed List installed packages only (enabled by default, only present for BC).
- -p, --platform List platform packages only
- -a, --available List available packages only
- -s, --self Show the root package information
- -N, --name-only List package names only
- -P, --path Show package paths
- -t, --tree List the dependencies as a tree
- -l, --latest Show the latest version
- -o, --outdated Show the latest version but only for outdated packages
- --ignore=IGNORE Ignore specified package(s). Use it with the --outdated option if you don't want to be informed about new versions of some packages. (multiple values allowed)
- -m, --minor-only Show only packages that have minor SemVer-compatible updates. Use with the --outdated option.
- -D, --direct Shows only packages that are directly required by the root package
- --strict Return a non-zero exit code when there are outdated packages
- -f, --format=FORMAT Format of the output: text or JSON [default: "text"]
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
composer outdated [options] [--] []
composer show -l [--] [] []
composer outdated is simply a proxy for `composer show -l`, the two, in fact, perform exactly the same task
Which is to show information about one or a list of packages their current version and the latest version available.
It also adds a coding colour (only if you have ANSI colour enabled otherwise it will be a signature) that indicates how easy would be to implement each package to your application
Here is how it works:
- green or (=): Dependency is in the latest version and is up to date.
- Yellow or (~): Dependency has a new version available that includes backwards compatibility breaks according to semver, so upgrade when you can but it may involve work.
- Red or (!): Dependency has a new version that is semver-compatible and you should upgrade it.
If you see any red or yellow you should run the command composer update.
The flag for this one are:
- -o, --outdated Show only packages that are outdated (this is the default, but present here for the compact flag with `show`
- -a, --all Show all installed packages with their latest versions
- -D, --direct Shows only packages that are directly required by the root package
- --strict Return a non-zero exit code when there are outdated packages
- -m, --minor-only Show only packages that have minor SemVer-compatible updates. Use with the --outdated option.
- -f, --format=FORMAT Format of the output: text or JSON [default: "text"]
- --ignore=IGNORE Ignore specified package(s). Use it with the --outdated option if you don't want to be informed about new versions of some packages. (multiple values allowed)
- -h, --help Display this help message
- -q, --quiet Do not output any message
- -V, --version Display this application version
- --ansi Force ANSI output
- --no-ansi Disable ANSI output
- -n, --no-interaction Do not ask any interactive question
- --profile Display timing and memory usage information
- --no-plugins Whether to disable plugins.
- -d, --working-dir=WORKING-DIR If specified, use the given directory as the working directory.
- --no-cache Prevent use of the cache
- -v|vv|vvv, --verbose Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug
Conclusion
As I said previously Composer is one of the most important tools that you must learn if you want to take your career as a PHP developer seriously.
In this post, we have seen some of the first 10 commands now available on your arsenal.
as I said previously my advise is to read through them and try to understand what they do and what flag you may find more useful during your day to day job.
You don't need to learn every command and every flag by heart,
it would be enough for you to know that these commands exist and when to actually use them.
In the following posts, we are going to discover more command and some Composer tricks, for this reason, if you haven't done it already add your email to the subscription form and be notified as soon as the article comes out.
What you can do now?
after learning about tools it is good to go back and brush up you PHP knowledge, you can do that by reading the basics of PHP
Otherwise, you can jump on another series and learn about Domain-driven design.
