# Install composer with Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper Dependency Manager for PHP. Version 2.10.2 via Homebrew; verified 2026-07-01. ## Install ```sh sudo av install brew:composer ``` ## Agent safety answer composer manages PHP dependencies and package publishing workflows. - **Credential access:** Reads auth.json, repository tokens, environment variables, and project config. - **Remote mutation:** Can install packages and run scripts that affect remote systems. - **Publish/artifact risk:** Can publish packages or build deployable PHP artifacts. - **Recommended control:** Gate scripts, publish operations, and credentialed repository access. - **Agent-use guidance:** Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials. Additional install commands: ### macOS - Homebrew (100%): ```sh brew install composer ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add composer ``` Evidence: Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install composer ``` Evidence: Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install composer ``` Evidence: Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - pacman (92%): ```sh sudo pacman -S composer ``` Evidence: Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install php-composer ``` Evidence: openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install composer ``` Evidence: Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cmake.portable' - Scoop (92%): ```sh scoop install main/composer ``` Evidence: Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:composer - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.10.2 - **Source summary:** Dependency Manager for PHP - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-07-01T13:09:12Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - composer (cli) - composer (alias) ## Dependencies - php ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 2.10.2 - Package-manager updated: 2026-07-01 - Local data: ok - Upstream repository: https://getcomposer.org/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager. ### Project history Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages. ### Adoption history Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem. ### How it is used Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew. ### Why package nerds care Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers. ### Timeline - 2012: Packagist records `composer/composer` 1.0.0-alpha1. - 2013: GitHub releases include Composer 1.0.0-alpha1. - 2016: Composer 1.0.0 was released. - 2020: Composer 2.0.0 was released. - 2026: Packagist continues to track active Composer 2.x development. ### Related projects - Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design. ### Sources - - - - - - - - ## Security Notes infrastructure mutation or orchestration signal. - **Geiger risk:** orange / medium - infrastructure mutation or orchestration signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Credential files - macOS: ~/Library/Application Support/Composer/auth.json - Unix: $XDG_CONFIG_HOME/composer/auth.json, ~/.composer/auth.json ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** composer - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - composer - 2.8.8-1+deb13u2: normalized package name match | Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dependency manager for PHP | https://getcomposer.org/ - Ubuntu apt - composer - 2.7.1-2: normalized package name match | Ubuntu 24.04 LTS package indexes: composer from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | dependency manager for PHP | https://getcomposer.org/ - apk - composer - 2.10.1-r0: normalized package name match | Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Dependency manager for PHP | https://getcomposer.org/ - apk - composer-bash-completion - 2.10.1-r0: normalized package name match | Alpine Linux edge package indexes: composer-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for composer | https://getcomposer.org/ - dnf - composer - 2.10.1-1.fc45: normalized package name match | Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Dependency Manager for PHP | https://getcomposer.org/ - pacman - composer - 2.10.1-1: normalized package name match | Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Dependency Manager for PHP | https://getcomposer.org/ - zypper - php-composer - 1.10.26-2.7: normalized package name match | openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/ - zypper - php-composer2 - 2.10.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: php-composer2 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/ - Chocolatey - composer: normalized package name match | Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cmake.portable' - Scoop - main/composer: normalized package name match | Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Related links - [Package publisher tools](https://www.automicvault.com/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [php](https://www.automicvault.com/pkg/brew/php/) - Runtime dependency declared by Homebrew. - [phive](https://www.automicvault.com/pkg/brew/phive/) - Shares av.db curated category or tags: cli, developer-tools, package-management, php. - [conan](https://www.automicvault.com/pkg/brew/conan/) - Shares av.db curated category or tags: cli, dependency-manager, developer-tools, package-management, package-manager. - [mint](https://www.automicvault.com/pkg/brew/mint/) - Shares av.db curated category or tags: cli, dependency-manager, developer-tools, package-management, package-manager. - [nuget](https://www.automicvault.com/pkg/brew/nuget/) - Shares av.db curated category or tags: cli, developer-tools, package-management, package-manager, packages. - [akku](https://www.automicvault.com/pkg/brew/akku/) - Shares av.db curated category or tags: cli, developer-tools, package-management, package-manager. - [bower](https://www.automicvault.com/pkg/brew/bower/) - Shares av.db curated category or tags: cli, developer-tools, package-management, package-manager. - [cabal-install](https://www.automicvault.com/pkg/brew/cabal-install/) - Shares av.db curated category or tags: cli, developer-tools, package-management, package-manager. - [clib](https://www.automicvault.com/pkg/brew/clib/) - Shares av.db curated category or tags: cli, developer-tools, package-management, package-manager. ## Combined YAML source View the package source record on GitHub. [combined/composer.yml](https://github.com/automic-vault/db/blob/main/combined/composer.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph - curated agent safety answer