Credential access
Reads auth.json, repository tokens, environment variables, and project config.
brew
Install composer with Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper
Dependency Manager for PHP. Version 2.10.2 via Homebrew; verified 2026-07-01.
agent safety
Agent safety answer
composer manages PHP dependencies and package publishing workflows.
Remote mutation
Can install packages and run scripts that affect remote systems.
Publish/artifact risk
Can publish packages or build deployable PHP artifacts.
Recommended control
Gate scripts, publish operations, and credentialed repository access.
Agent-use guidance
Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.
install
Additional install commands
macOS
Homebrewverified · 100%
brew install composerlocal Homebrew formula metadata
Linux
Alpine Linux apkverified · 92%
sudo apk add composerAlpine Linux edge package indexes · composer · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install composerDebian stable package indexes · composer · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install composerFedora Rawhide package metadata · composer · source: dl.fedoraproject.org
Arch Linux pacmanverified · 92%
sudo pacman -S composerArch Linux sync databases · composer · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install php-composeropenSUSE Tumbleweed package metadata · php-composer · source: download.opensuse.org
Windows
Chocolateyverified · 92%
choco install composerChocolatey community package catalog · composer · source: community.chocolatey.org
Scoopverified · 92%
scoop install main/composerScoop official bucket manifest trees · bucket/composer.json · source: api.github.com
overview
Package summary
Dependency Manager for PHP
Project links
Commands and aliases
- composer
history
Project history and usage
Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.
Project history
Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.
Adoption history
Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.
How it is used
Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.
Why package nerds care
Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.
Timeline
- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.
Related projects
- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.
Sources
- https://getcomposer.org/doc/00-intro.md
- https://github.com/composer/composer
- https://raw.githubusercontent.com/composer/composer/main/README.md
- https://packagist.org/packages/composer/composer.json
- https://github.com/composer/composer/releases/tag/1.0.0-alpha1
- https://github.com/composer/composer/releases/tag/1.0.0
- https://github.com/composer/composer/releases/tag/2.0.0
- https://getcomposer.org/doc/articles/authentication-for-private-packages.md
security posture
Risk level: orange
infrastructure mutation or orchestration signal.
Risk classifier
orange risk · medium confidence · infrastructure
Why
- infrastructure mutation or orchestration signal
Signals
- text:dependency manager
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 1 runtime dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- macOS
~/Library/Application Support/Composer/auth.json- Unix
$XDG_CONFIG_HOME/composer/auth.json~/.composer/auth.json
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
composer | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version2.10.2
manager updated2026-07-01
local dataok
upstreamnot checked
latest detectednot detected
- infoRelease/tag comparison is only available for GitHub repositories.https://getcomposer.org/none confidence
install metadata
Package metadata
| Package key | brew:composer |
|---|---|
| Version | 2.10.2 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/composer |
| Homepage | https://getcomposer.org/ |
| Repository | https://github.com/composer/composer |
| Upstream docs | https://getcomposer.org/doc |
| License | MIT |
| Source archive | https://getcomposer.org/download/2.10.2/composer.phar |
| Last updated | 2026-07-01T13:09:12Z |
| Pulse | updated |
| Dependencies | php |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | composer |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
composer 2.8.8-1+deb13u2
dependency manager for PHP
sudo apt install composer- Section: php
- Architecture: all
- 18 dependencies
- 10 optional deps
- normalized package name match
- Matched by: Composer
Ubuntu apt95%
composer 2.7.1-2
dependency manager for PHP
sudo apt install composer- Section: universe/php
- Architecture: all
- 18 dependencies
- 10 optional deps
- normalized package name match
- Matched by: Composer
apk95%
composer 2.10.1-r0
Dependency manager for PHP
sudo apk add composer- License: MIT
- Architecture: x86_64
- Source Package: composer
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Composer
apk95%
composer-bash-completion 2.10.1-r0
Bash completions for composer
sudo apk add composer-bash-completion- License: MIT
- Architecture: x86_64
- Source Package: composer
- normalized package name match
- Matched by: Composer
dnf95%
composer 2.10.1-1.fc45
Dependency Manager for PHP
sudo dnf install composer- License: MIT
- Category: Unspecified
- Architecture: noarch
- Source Package: composer
- 27 dependencies
- 4 provides
- normalized package name match
- Matched by: Composer
pacman95%
composer 2.10.1-1
Dependency Manager for PHP
sudo pacman -S composer- License: MIT
- Architecture: any
- 2 dependencies
- normalized package name match
- Matched by: Composer
zypper95%
php-composer 1.10.26-2.7
Dependency Management for PHP
sudo zypper install php-composer- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer
- 8 dependencies
- 5 provides
- normalized package name match
- Matched by: Composer
zypper95%
php-composer2 2.10.0-1.1
Dependency Management for PHP
sudo zypper install php-composer2- License: MIT
- Category: Development/Libraries/Other
- Architecture: noarch
- Source Package: php-composer2
- 8 dependencies
- 4 provides
- normalized package name match
- Matched by: Composer
Chocolatey95%
composer
choco install composer- normalized package name match
- Matched by: Composer
Scoop95%
main/composer
scoop install main/composer- normalized package name match
- Matched by: Composer
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment