Composer

Composer at a glance

Composer is the standard dependency manager for PHP, central to virtually every modern PHP project and its build pipeline. Composer ships regular releases plus security fixes; as tooling that resolves and installs code from packagist and other sources, integrity and currency matter.

For admins Composer downloads and executes package code (including install scripts), so it's a supply-chain surface: keep it current (it has had security advisories of its own), pin dependency versions with the lock file for reproducible installs, and use trusted repositories. Audit dependencies for known vulnerabilities (composer audit helps). On servers and CI, run installs with the lock file (composer install, not update) so you get the reviewed versions. Keep the underlying PHP supported. After upgrading Composer, verify that installs and the autoloader work. The packages you pull carry their own risk — the discipline is pinning and auditing. Patchletter surfaces new Composer releases.