PHP Composer: Manage Packages on VPS

June 2026 · 7 min read

Composer is the dependency manager for PHP that every modern PHP project needs to use, whether it's Laravel, Symfony, or a small project. Composer manages library versions, automatically loads classes, and prevents dependency conflicts. This article covers everything from installation to production optimization.

Install Composer

sudo apt install php-cli php-curl php-zip unzip -y

# Download installer
cd /tmp
curl -sS https://getcomposer.org/installer -o composer-setup.php

# Verify hash (check latest value at getcomposer.org/download/)
php composer-setup.php --install-dir=/usr/local/bin --filename=composer

# Check version
composer --version

Start a New Project

# Create composer.json
composer init

# Or create a project using a template (Laravel)
composer create-project laravel/laravel myapp

# Install a package
composer require guzzlehttp/guzzle
composer require --dev phpunit/phpunit

Composer Basics

# Install dependencies from composer.json
composer install

# Update all packages
composer update

# Update a single package
composer update guzzlehttp/guzzle

# Remove a package
composer remove vendor/package-name

# View installed packages
composer show

Optimize for Production

# Generate classmap autoloader (faster than PSR-4 autoloading)
composer install --no-dev --optimize-autoloader

# Or separate the steps
composer dump-autoload --optimize --no-dev

# Check how large the autoload map is
wc -l vendor/composer/autoload_classmap.php

composer.json Versioning

{
  "require": {
    "php": "^8.2",
    "guzzlehttp/guzzle": "^7.0",   // >= 7.0.0 < 8.0.0
    "monolog/monolog": "~2.0",      // >= 2.0.0 < 3.0.0
    "some/package": "2.1.0"         // exact version (not recommended)
  }
}

Verify Composer is Working Correctly

# Check version and system requirements
composer --version
composer diagnose

# Verify autoloader is working
php -r "require 'vendor/autoload.php'; echo 'Autoloader OK';"

# Check for security vulnerabilities
composer audit

# Check for outdated dependencies
composer outdated

Common Issues & Troubleshooting

Error: "Your requirements could not be resolved"

The package requires a PHP version or extension that doesn't match your server:

# Check what PHP version and extensions you have
php -v
php -m | sort

# Check what a package requires
composer why vendor/package

# Fix by changing the package version or upgrading PHP

Composer uses too much memory and stops halfway

PHP memory_limit is too low. Composer needs a lot of RAM when resolving dependencies:

# Run with a higher memory limit
COMPOSER_MEMORY_LIMIT=-1 composer install

# Or set it in php.ini
sudo sed -i 's/memory_limit = .*/memory_limit = 1G/' /etc/php/8.3/cli/php.ini

vendor/ directory is huge and eating up disk space

In production, use --no-dev and don't commit vendor/ in git:

# Add to .gitignore
/vendor/

# Remove dev packages
composer install --no-dev

# Check vendor size
du -sh vendor/

Class not found after adding a new class

The autoloader classmap hasn't been updated yet. You need to regenerate it:

# Regenerate autoload classmap
composer dump-autoload

# Or if using optimized autoloader
composer dump-autoload --optimize

Frequently Asked Questions

What is composer.lock and should I commit it to git?

composer.lock records the exact version of every installed package. You should always commit it to git. When other developers run composer install, they get the same versions. This prevents the "works on my machine" problem.

What's the difference between composer install and composer update?

install installs the version specified in composer.lock (reproducible). update finds new versions that match the constraints in composer.json and updates the lock file. Use install for production deployment and update only during development.

Can I use Composer with private packages or private repositories?

Yes. Add the repository type to composer.json: "repositories": [{"type": "vcs", "url": "[email protected]:company/private-repo.git"}] and then require the package normally. You need an SSH key or token with access permissions.