Accès aux identifiants
Reads auth.json, repository tokens, environment variables, and project config.
brew
Installer composer avec Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper
Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de composer pour les workflows d'agents IA.
sécurité des agents
Réponse sur la sécurité des agents
composer manages PHP dependencies and package publishing workflows.
Modification distante
Can install packages and run scripts that affect remote systems.
Risque de publication ou d'artéfact
Can publish packages or build deployable PHP artifacts.
Contrôle recommandé
Gate scripts, publish operations, and credentialed repository access.
Conseils d'utilisation par les agents
Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.
installation
Commandes d'installation supplémentaires
macOS
Homebrewvérifié · 100%
brew install composerlocal Homebrew formula metadata
Linux
Alpine Linux apkvérifié · 92%
sudo apk add composerAlpine Linux edge package indexes · composer · Source: dl-cdn.alpinelinux.org
Debian aptvérifié · 92%
sudo apt install composerDebian stable package indexes · composer · Source: deb.debian.org
Fedora dnfvérifié · 92%
sudo dnf install composerFedora Rawhide package metadata · composer · Source: dl.fedoraproject.org
Arch Linux pacmanvérifié · 92%
sudo pacman -S composerArch Linux sync databases · composer · Source: geo.mirror.pkgbuild.com
openSUSE zyppervérifié · 92%
sudo zypper install php-composeropenSUSE Tumbleweed package metadata · php-composer · Source: download.opensuse.org
Windows
Chocolateyvérifié · 92%
choco install composerChocolatey community package catalog · composer · Source: community.chocolatey.org
Scoopvérifié · 92%
scoop install main/composerScoop official bucket manifest trees · bucket/composer.json · Source: api.github.com
aperçu
Résumé du paquet
Dependency Manager for PHP
Liens du projet
Commandes et alias
- composer
historique
Historique du projet et usages
Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.
Historique du projet
Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.
Historique d'adoption
Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.
Modes d'utilisation
Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.
Pourquoi les passionnés de paquets s'y intéressent
Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.
Chronologie
- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.
Related projects
- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.
Sources
- https://getcomposer.org/doc/00-intro.md
- https://github.com/composer/composer
- https://raw.githubusercontent.com/composer/composer/main/README.md
- https://packagist.org/packages/composer/composer.json
- https://github.com/composer/composer/releases/tag/1.0.0-alpha1
- https://github.com/composer/composer/releases/tag/1.0.0
- https://github.com/composer/composer/releases/tag/2.0.0
- https://getcomposer.org/doc/articles/authentication-for-private-packages.md
posture de sécurité
Niveau de risque : orange
infrastructure mutation or orchestration signal.
Classificateur de risque
risque orange · confiance moyen · infrastructure
Pourquoi
- infrastructure mutation or orchestration signal
Signaux
- text:dependency manager
Comportement d'installation
- Aucun hook post-install Homebrew n’est enregistré dans les métadonnées de formule.
- Les métadonnées de bottle Homebrew sont disponibles pour 6 plateformes.
- S’installe avec 1 dépendances d’exécution.
Revue recommandée
Avant une utilisation sans surveillance par un agent, vérifiez si l'outil lit des identifiants en clair, écrit un état distant, publie des artefacts ou lance des plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- macOS
~/Library/Application Support/Composer/auth.json- Unix
$XDG_CONFIG_HOME/composer/auth.json~/.composer/auth.json
exécutables
Exécutables installés
| Commande | Type | Exposition | Note |
|---|---|---|---|
composer | cli | exécutable global |
fraîcheur
Version et fraîcheur
Ces signaux séparent l'âge de génération de la page, l'activité du gestionnaire de paquets et la comparaison avec les versions amont. Un retard de version n'est signalé que lorsqu'une URL de preuve et des versions comparables sont présentes.
page générée2026-07-10
version du gestionnaire2.10.2
gestionnaire mis à jour2026-07-01
données localesOK
amontnot checked
dernière version détectéenon détecté
- infoRelease/tag comparison is only available for GitHub repositories.https://getcomposer.org/confiance none
métadonnées d'installation
Métadonnées du paquet
| Clé du paquet | brew:composer |
|---|---|
| Version | 2.10.2 |
| Gestionnaire de paquets | Homebrew |
| Page du gestionnaire de paquets | https://formulae.brew.sh/formula/composer |
| Page d'accueil | https://getcomposer.org/ |
| Dépôt | https://github.com/composer/composer |
| Docs amont | https://getcomposer.org/doc |
| Licence | MIT |
| Archive source | https://getcomposer.org/download/2.10.2/composer.phar |
| Dernière mise à jour | 2026-07-01T13:09:12Z |
| Pulse | updated |
| Dépendances | php |
| Bouteille | disponible (sur arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| post-install Homebrew | non défini |
| Service | aucun déclaré |
faits du registre
Détails de la base source
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | composer |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
correspondances dans les bases sources
Autres enregistrements de gestionnaires de paquets
Les correspondances proviennent d’index externes de gestionnaires de paquets et restent séparées des liens de paquets Automic Vault locaux.
Debian apt95%
composer 2.8.8-1+deb13u2
dependency manager for PHP
sudo apt install composer- Section: php
- Architecture: all
- 18 Dépendances
- 10 dépendances optionnelles
- normalized package name match
- Correspondance par : Composer
Ubuntu apt95%
composer 2.7.1-2
dependency manager for PHP
sudo apt install composer- Section: universe/php
- Architecture: all
- 18 Dépendances
- 10 dépendances optionnelles
- normalized package name match
- Correspondance par : Composer
apk95%
composer 2.10.1-r0
Dependency manager for PHP
sudo apk add composer- License: MIT
- Architecture: x86_64
- Source Package: composer
- 1 Dépendances
- 1 fournit
- normalized package name match
- Correspondance par : Composer
apk95%
composer-bash-completion 2.10.1-r0
Bash completions for composer
sudo apk add composer-bash-completion- License: MIT
- Architecture: x86_64
- Source Package: composer
- normalized package name match
- Correspondance par : Composer
dnf95%
composer 2.10.1-1.fc45
Dependency Manager for PHP
sudo dnf install composer- License: MIT
- Category: Unspecified
- Architecture: noarch
- Source Package: composer
- 27 Dépendances
- 4 fournit
- normalized package name match
- Correspondance par : Composer
pacman95%
composer 2.10.1-1
Dependency Manager for PHP
sudo pacman -S composer- License: MIT
- Architecture: any
- 2 Dépendances
- normalized package name match
- Correspondance par : Composer
zypper95%
php-composer 1.10.26-2.7
Dependency Management for PHP
sudo zypper install php-composer- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer
- 8 Dépendances
- 5 fournit
- normalized package name match
- Correspondance par : Composer
zypper95%
php-composer2 2.10.0-1.1
Dependency Management for PHP
sudo zypper install php-composer2- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer2
- 8 Dépendances
- 4 fournit
- normalized package name match
- Correspondance par : Composer
Chocolatey95%
composer
choco install composer- normalized package name match
- Correspondance par : Composer
Scoop95%
main/composer
scoop install main/composer- normalized package name match
- Correspondance par : Composer
piste source
Généré depuis les données du dépôt
Cette page est servie par av-web depuis l'artéfact SQLite privé des paquets généré par scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Sources utilisées
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment