Semantic versioning — ^1.2.3, ~1.2, *, stability flags

Beginner5 min read·php-12-002

interview

Concept

composer.json is the manifest file for your PHP project. It declares your package name, description, dependencies, autoloading configuration, scripts, and more.

Key fields:

name: vendor/package-name format. Required if publishing to Packagist.
description: One-line description.
require: Production dependencies — {"package": "version-constraint"}.
require-dev: Development-only dependencies (testing, linting, debugging). Not installed in production when using composer install --no-dev.
autoload: PSR-4 class loading configuration — maps namespace prefixes to directory paths.
autoload-dev: Autoloading for dev-only classes (tests).
scripts: Shell commands that run at lifecycle events or as named scripts.
config: Composer behavior settings (optimize-autoloader, sort-packages, etc.).
minimum-stability: Minimum stability of packages to allow (stable, RC, beta, alpha, dev).
prefer-stable: Always prefer stable over unstable releases when both are acceptable.
extra: Arbitrary metadata (used by frameworks like Laravel for scaffolding).

type field: library, project, metapackage, composer-plugin. Most apps use project.

Code Example

json

{
    "name": "mycompany/my-app",
    "description": "The Framework Architect learning platform",
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": "^8.2",
        "laravel/framework": "^11.0",
        "guzzlehttp/guzzle": "^7.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^11.0",
        "phpstan/phpstan": "^1.0",
        "laravel/pint": "^1.0",
        "barryvdh/laravel-debugbar": "^3.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "Database\\Factories\\": "database/factories/",
            "Database\\Seeders\\": "database/seeders/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "scripts": {
        "post-install-cmd": [
            "@php artisan key:generate --ansi"
        ],
        "post-update-cmd": [
            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
        ],
        "test": "php artisan test",
        "lint": "vendor/bin/pint --test",
        "analyse": "vendor/bin/phpstan analyse"
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true,
        "allow-plugins": {
            "php-http/discovery": true
        }
    },
    "minimum-stability": "stable",
    "prefer-stable": true,
    "extra": {
        "laravel": {
            "dont-discover": []
        }
    }
}

PreviousComposer fundamentals — composer.json, composer.lock, vendor/Composer & PSR Standards NextComposer autoloading — PSR-4, classmap, filesComposer & PSR Standards