composer require, update, install — what each does to the lock file

Concept

PSR-4 (PHP Standard Recommendation #4) is the autoloading standard used universally in modern PHP. It defines a mapping between a fully-qualified class name and a file path, allowing autoloaders to find any class without a manually maintained list.

The mapping rule: Given a namespace prefix mapped to a base directory, the rest of the FQCN maps to a subdirectory path. Class App\Http\Controllers\UserController with prefix App\\ mapped to app/ → file path app/Http/Controllers/UserController.php. The case matters: class name must match filename exactly.

Before PSR-4 there was PSR-0: Similar but included the class name itself in the path conversion — underscores in class names became directory separators (App_Http_Request → App/Http/Request.php). PSR-0 is deprecated; don't use it for new projects.

classmap: Alternative to PSR-4. Composer scans directories and builds a class → file map at vendor/composer/autoload_classmap.php. Useful for legacy code that doesn't follow PSR-4 conventions. composer dump-autoload --classmap-authoritative builds a complete classmap and uses only it (fastest, but requires dump-autoload after every new file).

files: Explicitly included PHP files — loaded on every request. Use for global helpers: "files": ["src/helpers.php"]. Avoid overusing — every listed file is always included.

Performance: Development: use PSR-4 (scans disk on miss). Production: --optimize-autoloader generates a classmap for instant lookup. --classmap-authoritative also disables fallback to PSR-4 scanning for maximum performance.

Code Example

{
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "Domain\\": "src/Domain/",
            "Infrastructure\\": "src/Infrastructure/"
        },
        "classmap": [
            "database/migrations"
        ],
        "files": [
            "src/helpers.php"
        ]
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    }
}

PSR-4 mapping examples with "App\\": "app/":

App\Models\User          → app/Models/User.php
App\Http\Controllers\Api\UserController → app/Http/Controllers/Api/UserController.php
App\Services\Payment\StripeService → app/Services/Payment/StripeService.php

<?php
// helpers.php (loaded via files[] — always available)
if (!function_exists('money_format_euro')) {
    function money_format_euro(int $cents): string {
        return '€' . number_format($cents / 100, 2);
    }
}

// Class that follows PSR-4 — must be in app/Services/UserService.php
namespace App\Services;

class UserService
{
    // Autoloaded automatically — no require needed
}

// After adding new PSR-4 directories or classmap entries:
// composer dump-autoload
// composer dump-autoload --optimize   (production)
// composer dump-autoload --classmap-authoritative  (maximum performance)