Composer & Autoloading

Composer is PHP's per-project dependency manager. Required packages are declared in composer.json, and composer install resolves their versions, downloads them into vendor/, and generates vendor/autoload.php. The vendor/ tree is build output — you neither edit it nor commit it.

composer.json states version ranges; composer.lock records the exact version Composer actually resolved for every package, transitive ones included. Committing it makes composer install reproducible — CI, teammates and production all get identical dependencies. Only composer update re-resolves and rewrites it.

A namespace prefixes every class, interface and function a file declares, so Acme\Log\Logger and Vendor\Log\Logger are two distinct fully-qualified names the engine never confuses. Both packages may ship a class literally called Logger: identity is the full prefixed name, not the short one.

require lists packages the application needs in order to run; require-dev lists tooling needed only while developing — PHPUnit, PHPStan, fixture builders. A plain composer install installs both, but composer install --no-dev on a production deploy skips the dev block, giving a smaller vendor/ and less attack surface.

PHP-FIG is a group of framework and library maintainers that publishes PSRs — PHP Standard Recommendations. A PSR is not part of the language and the engine never enforces it; it is an agreed contract: a set of interfaces (PSR-3 logging, PSR-7 HTTP messages) or a convention (PSR-4 autoloading, PSR-12 style).

composer.json maps a namespace prefix onto a base directory — say App\ onto src/. On the first use of an undefined class the registered autoloader strips that prefix, turns the remaining separators into directory separators and appends .php, so App\Http\Kernel becomes src/Http/Kernel.php.

Both allow updates up to the next breaking change, but they draw the line differently. ^1.2.3 allows anything below 2.0.0 — minor and patch releases. ~1.2.3 allows patches only, so anything below 1.3.0. On a 0.x version ^ tightens: ^0.2.3 stays below 0.3.0.

A top-of-file use is a compile-time alias — it lets you write Logger for Acme\Log\Logger in that one file, and it loads nothing at all. The other two merely reuse the same token: use inside a class body composes a trait, and use ($x) after a closure signature captures an outer variable.

Plain PSR-4 turns a class name into a path and hits the filesystem — a stat per candidate prefix — on the first use of each class, on every request. composer dump-autoload --optimize precomputes a static class-to-file map, so a lookup becomes one array read; --classmap-authoritative drops the PSR-4 fallback too.

They define shared interfaces, not implementations. A library type-hinting Psr\Log\LoggerInterface or PSR-7's ServerRequestInterface runs under Monolog, Laravel or Symfony alike — the framework only has to supply a class implementing that contract. The dependency points at an interface package, never at a framework.

Extract what has a stable contract and no dependency on the application; anything that knows about controllers or routes stays in the app. During development wire packages in through a path repository so edits apply instantly, and publish tagged releases to a private registry for the second app. Each package owns one namespace and one PSR-4 root.

First confirm the job runs composer install and not update — with a committed lock there is nothing to re-resolve. Then cache Composer's global cache directory, keyed by the hash of composer.lock, so an unchanged lock reuses previous downloads. On deploy jobs add --no-dev --prefer-dist --no-progress.

Bump the major version: a caret constraint stops consumers picking it up, so nothing breaks on composer update. Before that, release a minor adding the new method beside the old one and marking the old @deprecated, so applications migrate one at a time. Keep the previous major on a maintenance branch for the laggard.