Credential-Zugriff
Reads auth.json, repository tokens, environment variables, and project config.
brew
composer mit Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für composer in AI-Agent-Workflows.
Agent-Sicherheit
Antwort zur Agent-Sicherheit
composer manages PHP dependencies and package publishing workflows.
Änderungen an Remote-Zustand
Can install packages and run scripts that affect remote systems.
Publish-/Artefakt-Risiko
Can publish packages or build deployable PHP artifacts.
Empfohlene Kontrolle
Gate scripts, publish operations, and credentialed repository access.
Hinweise für Agent-Nutzung
Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.
Installation
Weitere Installationsbefehle
macOS
Homebrewverifiziert · 100%
brew install composerlocal Homebrew formula metadata
Linux
Alpine Linux apkverifiziert · 92%
sudo apk add composerAlpine Linux edge package indexes · composer · Quelle: dl-cdn.alpinelinux.org
Debian aptverifiziert · 92%
sudo apt install composerDebian stable package indexes · composer · Quelle: deb.debian.org
Fedora dnfverifiziert · 92%
sudo dnf install composerFedora Rawhide package metadata · composer · Quelle: dl.fedoraproject.org
Arch Linux pacmanverifiziert · 92%
sudo pacman -S composerArch Linux sync databases · composer · Quelle: geo.mirror.pkgbuild.com
openSUSE zypperverifiziert · 92%
sudo zypper install php-composeropenSUSE Tumbleweed package metadata · php-composer · Quelle: download.opensuse.org
Windows
Chocolateyverifiziert · 92%
choco install composerChocolatey community package catalog · composer · Quelle: community.chocolatey.org
Scoopverifiziert · 92%
scoop install main/composerScoop official bucket manifest trees · bucket/composer.json · Quelle: api.github.com
Überblick
Paketzusammenfassung
Dependency Manager for PHP
Projektlinks
Befehle und Aliase
- composer
Verlauf
Projektgeschichte und Nutzung
Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.
Projektgeschichte
Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.
Adoptionsgeschichte
Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.
Wie es verwendet wird
Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.
Warum Paket-Nerds sich dafür interessieren
Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.
Zeitleiste
- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.
Related projects
- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.
Quellen
- https://getcomposer.org/doc/00-intro.md
- https://github.com/composer/composer
- https://raw.githubusercontent.com/composer/composer/main/README.md
- https://packagist.org/packages/composer/composer.json
- https://github.com/composer/composer/releases/tag/1.0.0-alpha1
- https://github.com/composer/composer/releases/tag/1.0.0
- https://github.com/composer/composer/releases/tag/2.0.0
- https://getcomposer.org/doc/articles/authentication-for-private-packages.md
Sicherheitslage
Risikostufe: orange
infrastructure mutation or orchestration signal.
Risikoklassifikator
orange Risiko · mittel Konfidenz · infrastructure
Warum
- infrastructure mutation or orchestration signal
Signale
- text:dependency manager
Installationsverhalten
- In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
- Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
- Installiert mit 1 Laufzeitabhängigkeiten.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- macOS
~/Library/Application Support/Composer/auth.json- Unix
$XDG_CONFIG_HOME/composer/auth.json~/.composer/auth.json
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
composer | cli | globales Executable |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-07-10
Manager-Version2.10.2
Manager aktualisiert2026-07-01
lokale DatenOK
Upstreamnot checked
neueste erkannte Versionnicht erkannt
- InfoRelease/tag comparison is only available for GitHub repositories.https://getcomposer.org/none Konfidenz
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:composer |
|---|---|
| Version | 2.10.2 |
| Paketmanager | Homebrew |
| Paketmanager-Seite | https://formulae.brew.sh/formula/composer |
| Homepage | https://getcomposer.org/ |
| Repository | https://github.com/composer/composer |
| Upstream-Dokumentation | https://getcomposer.org/doc |
| Lizenz | MIT |
| Quellarchiv | https://getcomposer.org/download/2.10.2/composer.phar |
| Zuletzt aktualisiert | 2026-07-01T13:09:12Z |
| Pulse | updated |
| Abhängigkeiten | php |
| Bottle | verfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | nicht definiert |
| Dienst | keiner deklariert |
Registry-Fakten
Details aus der Quelldatenbank
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | composer |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
Source-Datenbank-Treffer
Andere Paketmanager-Einträge
Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.
Debian apt95%
composer 2.8.8-1+deb13u2
dependency manager for PHP
sudo apt install composer- Section: php
- Architecture: all
- 18 Abhängigkeiten
- 10 optionale Abhängigkeiten
- normalized package name match
- Abgeglichen nach: Composer
Ubuntu apt95%
composer 2.7.1-2
dependency manager for PHP
sudo apt install composer- Section: universe/php
- Architecture: all
- 18 Abhängigkeiten
- 10 optionale Abhängigkeiten
- normalized package name match
- Abgeglichen nach: Composer
apk95%
composer 2.10.1-r0
Dependency manager for PHP
sudo apk add composer- License: MIT
- Architecture: x86_64
- Source Package: composer
- 1 Abhängigkeiten
- 1 stellt bereit
- normalized package name match
- Abgeglichen nach: Composer
apk95%
composer-bash-completion 2.10.1-r0
Bash completions for composer
sudo apk add composer-bash-completion- License: MIT
- Architecture: x86_64
- Source Package: composer
- normalized package name match
- Abgeglichen nach: Composer
dnf95%
composer 2.10.1-1.fc45
Dependency Manager for PHP
sudo dnf install composer- License: MIT
- Category: Unspecified
- Architecture: noarch
- Source Package: composer
- 27 Abhängigkeiten
- 4 stellt bereit
- normalized package name match
- Abgeglichen nach: Composer
pacman95%
composer 2.10.1-1
Dependency Manager for PHP
sudo pacman -S composer- License: MIT
- Architecture: any
- 2 Abhängigkeiten
- normalized package name match
- Abgeglichen nach: Composer
zypper95%
php-composer 1.10.26-2.7
Dependency Management for PHP
sudo zypper install php-composer- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer
- 8 Abhängigkeiten
- 5 stellt bereit
- normalized package name match
- Abgeglichen nach: Composer
zypper95%
php-composer2 2.10.0-1.1
Dependency Management for PHP
sudo zypper install php-composer2- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer2
- 8 Abhängigkeiten
- 4 stellt bereit
- normalized package name match
- Abgeglichen nach: Composer
Chocolatey95%
composer
choco install composer- normalized package name match
- Abgeglichen nach: Composer
Scoop95%
main/composer
scoop install main/composer- normalized package name match
- Abgeglichen nach: Composer
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment