Composer Packages 📦

Create reusable PHP libraries, configure PSR-4 autoloading, understand semantic versioning, and publish packages to Packagist.

What You'll Learn in This Lesson

• Structure a Composer package with PSR-4 autoloading
• Write a proper composer.json with dependencies
• Understand semantic versioning (SemVer) and constraints
• Publish to Packagist and set up auto-updates
• Know when to commit composer.lock (apps vs libraries)

Note: PHP runs on a server. Our examples simulate PHP logic using JavaScript. To run real PHP, install PHP.

🎯 Real-World Analogy: Composer is like a LEGO catalog. Instead of sculpting every brick yourself, you browse the catalog (Packagist), order the pieces you need (composer require), and they arrive ready to snap into your project. Publishing a package is like adding your own custom brick to the catalog for others to use.

Building a Package

A Composer package is a directory with a composer.json file, PSR-4 autoloaded source code in src/, and tests in tests/. The namespace maps to the directory structure: Acme\Validator\Rules\Email lives at src/Rules/Email.php.

Try It: Package Structure

Generate composer.json and explore the directory layout

Try it Yourself »

JavaScript

// Building & Publishing Composer Packages
console.log("=== What is Composer? ===");
console.log();
console.log("  Composer is PHP's package manager (like npm for Node.js).");
console.log("  Packagist.org is the default package registry.");
console.log();
console.log("  Key commands:");
console.log("  composer init          — Create a new package");
console.log("  composer require X     — Install a dependency");
console.log("  composer install       — Install from composer.lock");
console.log(" 
...

Versioning & Publishing

Semantic versioning tells users what to expect: patch (1.0.1) for bug fixes, minor (1.1.0) for new features, major (2.0.0) for breaking changes. The caret constraint (^1.2) is most common — it allows updates within the same major version.

Try It: SemVer & Publishing

Understand version constraints and the Packagist publishing workflow

Try it Yourself »

JavaScript

// Semantic Versioning & Publishing
console.log("=== Semantic Versioning (SemVer) ===");
console.log();
console.log("  MAJOR.MINOR.PATCH");
console.log("    1.0.0  →  Initial release");
console.log("    1.0.1  →  Bug fix (backward compatible)");
console.log("    1.1.0  →  New feature (backward compatible)");
console.log("    2.0.0  →  Breaking change (NOT backward compatible)");
console.log();

// Demonstrate version constraints
let constraints = [
  { constraint: "^1.2.3", meaning: ">=1.2.3 and
...

⚠️ Common Mistakes

⚠️

No .gitignore for vendor/ — Never commit the vendor/ directory to git. It's generated by composer install and can be hundreds of MB.

⚠️

Breaking SemVer — Changing a method signature without bumping the major version breaks downstream projects. Follow SemVer strictly.

💡

Pro Tip: Use composer outdated to see which dependencies have newer versions, and composer audit to check for security vulnerabilities.

📋 Quick Reference — Composer

Command	Purpose
composer init	Create a new composer.json interactively
composer require	Add and install a dependency
composer update	Update dependencies to latest allowed
composer audit	Check for known security vulnerabilities
PSR-4	Autoloading standard: namespace → directory

🎉 Lesson Complete!

You can now build and publish packages! Next, learn to deploy PHP apps with Nginx, PHP-FPM, and Docker.