composer commands cheatsheet.
Require, install, update and autoload — the Composer commands you use every day. Tap to copy.
composer initCreate a composer.json interactivelycomposer installInstall dependencies from composer.lockcomposer install --no-devInstall without dev dependencies (production)composer create-project <pkg> <dir>Scaffold a new project from a packagecomposer require <vendor/pkg>Add a package and update composer.jsoncomposer require --dev <pkg>Add a package as a dev dependencycomposer remove <pkg>Remove a package and its configcomposer updateUpdate all packages to latest allowed versionscomposer update <pkg>Update a single packagecomposer dump-autoloadRegenerate the autoloader filescomposer dump-autoload -oRegenerate an optimized autoloadercomposer run-script <name>Run a script defined in composer.jsoncomposer exec <cmd>Run a vendor binary from vendor/bincomposer showList installed packagescomposer outdatedShow packages with newer versions availablecomposer why <pkg>Show what depends on a packagecomposer validateValidate composer.json and composer.lockcomposer diagnoseCheck the system for common problemscomposer global require <pkg>Install a package globallycomposer self-updateUpdate Composer to the latest versioncomposer clear-cacheClear Composer's package cachecomposer --versionShow the installed Composer versionWhat Composer actually does
Composer is the dependency manager for PHP, and almost every modern PHP project leans on it for two jobs: pulling in libraries other people wrote, and wiring up autoloading so those classes just work. The file at the centre of it all is composer.json, which lists your dependencies and defines scripts, while composer.lock pins the exact versions that were resolved. When you clone a project, a single composer install reads the lock file and downloads everything into a vendor folder — the first command you'll run on almost any codebase.
Requiring the right way
Adding packages has a couple of flavours worth understanding. composer require <vendor/pkg> adds a normal dependency your app needs to run and updates both composer.json and composer.lock. composer require --dev <pkg> marks it as a dev dependency — tools like PHPUnit and static analysers that you need while building but not in production. On a server you then run composer install --no-dev so those dev tools stay out of your deployment, keeping it lean.
Autoloading and scripts
Composer generates a PSR-4 autoloader so you never write manual require statements. After adding classes outside of a package install you run composer dump-autoload to regenerate it, and composer dump-autoload -o builds an optimized class map that's recommended for production. The scripts section of composer.json defines project tasks run with composer run-script <name>, and composer exec runs a binary shipped by a package from vendor/bin without typing the full path.
Keeping things healthy
A few maintenance habits prevent trouble. composer outdated shows what has newer versions, composer update moves them forward within the ranges your composer.json allows, and composer why <pkg> explains which dependency pulled something in. composer validate checks your manifest before you commit, and composer diagnose hunts for common environment problems. These pair naturally with the Git commands for version control and the Docker commands when you containerise your app.