Managing Dependencies with Packagist

1. Discovering Packages on Packagist

Before you can install a dependency, you need to find it. The primary place the PHP community shares and discovers packages is Packagist. Think of it as the central app store for PHP libraries.

Whatever task you need to accomplish—sending emails, manipulating images, creating slugs for URLs—there's a high probability that someone has already written, tested, and shared a package for it on Packagist.

The following short video clip introduces Packagist and shows you how to search for a package.

When you find a package on Packagist, its page will give you all the information you need, most importantly, the exact command to install it.

Action Step:
Take a moment to explore. Go to Packagist.org and search for a few things you might need in a web application:

• logging (you'll likely see monolog/monolog)
• http client (you'll likely see guzzlehttp/guzzle)
• slug (you'll find libraries that convert text like "Hello World" into "hello-world")

Click on a few results and get familiar with the layout of a package page.

2. Installing a New Dependency with composer require

While you can manually add dependencies to your composer.json file and then run composer update, there is a much more direct and common way: the composer require command.

This single command automates the entire process for you:

1. It finds the package on Packagist.
2. It determines the latest stable version and adds the package to your composer.json file with an appropriate version constraint (usually the caret ^).
3. It downloads the package and any of its own dependencies into the vendor directory.
4. It updates your composer.lock file with the exact versions that were installed.

Let's watch this in action.

Hands-on Practice

Now, let's try it yourself. Open a terminal in the project directory you created in the previous lesson. We'll install a simple and useful package called cocur/slugify which converts strings into URL-friendly slugs.

Run the following command:

composer require cocur/slugify

After the command finishes, inspect your project files:

• composer.json: You will see a new line in the "require" section for "cocur/slugify".
• composer.lock: This file will have been created or updated with the exact version of cocur/slugify (and its dependencies) that was installed.
• vendor directory: You will now find a cocur directory inside, containing the slugify package code.

Composer is also smart enough to manage dependencies of dependencies. If you require a package that itself requires other packages, Composer handles the entire chain for you.

3. The install vs. update Commands

You now have two core commands for managing your vendor directory: composer install and composer update. It is critical to understand the difference.

• composer install: Reads the composer.lock file. It installs the exact versions specified in the lock file. This is the command you use to set up a project on a new machine or for deployment, ensuring everyone has the same dependencies. If no composer.lock file exists, it will run an update to create one.

• composer update: Reads the composer.json file. It looks for the latest versions available that match your version constraints (e.g., ^1.2.3), installs them, and then writes the new versions into the composer.lock file. You use this when you want to upgrade your project's dependencies to newer versions.

For a detailed explanation, please read the following guide.

The Team Workflow

This distinction is the key to consistent team development and reliable deployments:

1. A developer uses composer require <new-package> to add a feature. This updates composer.json and composer.lock.
2. They commit both composer.json and composer.lock to version control.
3. Other team members pull the latest code. They now have the updated lock file.
4. They run composer install. Composer reads the updated composer.lock and installs the exact same version of <new-package>, ensuring the entire team is synchronized.

The following video provides an excellent summary of this workflow and the importance of committing your composer.lock file.

Conclusion

You have now mastered the essential, practical commands for dependency management in PHP. You can find, add, and update the building blocks for any modern application.

Key Takeaways:

• Packagist.org is the main repository where you can find thousands of reusable PHP packages.
• composer require <vendor>/<package> is the command to add a new dependency to your project. It automatically updates composer.json and composer.lock.
• composer update is used to upgrade your project's dependencies to the latest versions allowed by composer.json, and it regenerates the composer.lock file.
• composer install is used to install the exact dependency versions listed in the composer.lock file, ensuring consistency across all environments and team members.

Preview of the Next Lesson:
We've successfully downloaded external code into our vendor directory. But how do we actually use it in our PHP files? The next lesson, "Configure and use a PSR-4 autoloader to automatically load class files", will answer that question. You will learn how to set up Composer's powerful autoloader, which eliminates the need for manual require or include statements.