Composer Packages

By the end of this lesson you'll manage third-party libraries with Composer, wire up PSR-4 autoloading so your classes load themselves, choose the right version constraints, and publish your own package to Packagist for the world to use.

Learn Python, JavaScript, Java and more with free interactive lessons, real projects and AI-powered help. Beginner-friendly.

Part of the free Php course at LearnCodingFast — hands-on lessons with examples you run in your browser, plus practice exercises and a quick quiz.

What You'll Learn in This Lesson

1️⃣ What Composer Is & the Four Commands

Composer is PHP's dependency manager — a tool that downloads the third-party libraries your project needs and keeps track of their versions. You almost never write a logging system, a date library, or an HTTP client yourself; you require a battle-tested one. There are four commands you'll use daily: composer init creates a new composer.json , composer require adds a package, composer install installs the exact versions a project already locked, and composer update upgrades to the newest versions your rules allow.

2️⃣ composer.json vs composer.lock

These two files trip up everyone at first, so make the distinction stick. composer.json is your wish list : it says which packages you want and the version ranges you'll accept. composer.lock is the receipt : Composer generates it automatically, recording the single exact version of every package — and every sub -dependency — it actually installed. Because the lock pins everything precisely, composer install reproduces the identical dependency tree on every machine.

3️⃣ PSR-4 Autoloading & vendor/autoload.php

In the old days you wrote a require for every single class file — tedious and fragile. PSR-4 is the modern standard that ends that: it maps a namespace prefix to a folder , so Composer can find a class file from its name alone. You declare the mapping once in composer.json , run composer dump-autoload , then require 'vendor/autoload.php' a single time. From then on, the first time you use a class, Composer loads the matching file for you. A sub-namespace simply means a sub-folder.

The magic is vendor/autoload.php — a file Composer writes for you. Including it registers an autoloader : a function PHP calls whenever you reference a class it hasn't loaded yet. It translates into src/Post.php and loads it on demand. If you add a new class and PHP says it can't find it, you usually just need to run composer dump-autoload to refresh the map.

4️⃣ Semantic Versioning & Constraints (^ vs ~)

Every package version is MAJOR.MINOR.PATCH — a patch is a bug fix, a minor adds features without breaking anything, and a major bump signals a breaking change. In composer.json you don't pin one fixed version; you give a constraint so you keep receiving safe fixes. The caret ^ is the common default — it allows everything up to the next major. The tilde ~ is stricter, usually allowing patch releases only.

5️⃣ Dev Dependencies & Scripts

Not every dependency ships to production. Tools like PHPUnit (testing) and PHPStan (static analysis) belong under require-dev — they're installed on your laptop and CI server but skipped on a production deploy with composer install --no-dev . You can also define scripts : named shortcuts for commands you run constantly, so a long incantation becomes a short composer test .

6️⃣ Your Turn: Install & Autoload

Now you try. The terminal session below is almost complete — fill in each ___ using the 👉 hint, then check it against the Output panel.

One more — this time PSR-4. The class is at src/Money/Price.php and the prefix maps to src/ . Give the class the matching namespace and load the autoloader.

📋 Quick Reference — Composer

No code is filled in this time — just a brief and an outline. Write it yourself, run the PHP part on onecompiler.com/php or your own machine, then check your result against the expected output in the comments. This mirrors how you'd actually scaffold a real package.

Practice quiz

• Browse all free courses
• Cheat sheets & quizzes
• Coding dictionary