Composer require and dependency management in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the composer require command do?

It adds a new package to your project and updates the composer.json and composer.lock files automatically.

beginner

What is the purpose of the composer.lock file?

It locks the exact versions of all installed packages to ensure consistent installs across different environments.

intermediate

How does Composer handle version conflicts between packages?

Composer tries to find a set of package versions that satisfy all version constraints. If it can't, it shows an error and stops the installation.

beginner

What is the difference between require and require-dev in Composer?

require is for packages needed in production, while require-dev is for packages only needed during development, like testing tools.

beginner

Why should you commit composer.lock to version control?

Committing composer.lock ensures everyone uses the same package versions, avoiding unexpected bugs caused by different dependencies.

What happens when you run composer require monolog/monolog?

A Composer updates PHP version.

B Only <code>composer.json</code> is updated, no packages installed.

C Monolog package is added and <code>composer.json</code> and <code>composer.lock</code> are updated.

D Composer removes all existing packages.

The composer require command adds the package and updates both composer.json and composer.lock.

Which file ensures consistent package versions across different machines?

A <code>vendor/composer</code>

B <code>composer.json</code>

C <code>autoload.php</code>

D <code>composer.lock</code>

composer.lock locks the exact versions of installed packages.

If two packages require conflicting versions of the same dependency, what does Composer do?

A Shows an error and stops installation.

B Ignores the conflict and installs both versions.

C Automatically picks the newest version.

D Removes one of the conflicting packages.

Composer stops and shows an error if it cannot resolve version conflicts.

Which command installs packages listed in require-dev?

A <code>composer install --no-dev</code>

B <code>composer install</code>

C <code>composer update --no-dev</code>

D <code>composer dump-autoload</code>

Running composer install installs both require and require-dev packages by default.

Why is it important to commit composer.lock to your project repository?

A To ensure all developers use the same package versions.

B To speed up Composer commands.

C To avoid installing any packages.

D To update PHP automatically.

Committing composer.lock ensures consistent dependency versions for all developers.

Explain how composer require helps manage dependencies in a PHP project.

Think about what files change and what happens to the package.

Describe the role of composer.lock and why it is important to commit it to version control.

Consider what happens if different developers have different versions.

Practice

1. What does the composer require command do in a PHP project?

easy

A. It adds a new package to composer.json and installs it.

B. It removes a package from the project.

C. It updates PHP to the latest version.

D. It creates a new PHP project from scratch.

Solution

1. Step 1: Understand the purpose of composer require

   This command adds a new package to the composer.json file and downloads the package files into the project.

2. Step 2: Compare with other options

   Removing packages is done with composer remove, updating PHP is unrelated, and creating projects uses other tools.

3. Final Answer:

   It adds a new package to composer.json and installs it. -> Option A

4. Quick Check:

   composer require = add and install package [OK]

Hint: Remember: require means add and install package [OK]

Common Mistakes:

• Confusing require with remove command
• Thinking it updates PHP version
• Assuming it creates new projects

2. Which of the following is the correct syntax to add the package monolog/monolog using Composer?

easy

A. composer install monolog/monolog

B. composer add monolog/monolog

C. composer require monolog/monolog

D. composer update monolog/monolog

Solution

1. Step 1: Recall Composer commands for adding packages

   The correct command to add a package is composer require <package-name>.

2. Step 2: Check other commands

   composer add is invalid, install installs all dependencies, and update updates existing packages.

3. Final Answer:

   composer require monolog/monolog -> Option C

4. Quick Check:

   Require = add package [OK]

Hint: Use 'composer require' to add packages, not 'add' or 'install' [OK]

Common Mistakes:

• Using 'composer add' instead of 'require'
• Confusing 'install' with adding packages
• Trying to update instead of add

3. Given the command composer require guzzlehttp/guzzle:^7.0, what will happen?

medium

A. Composer installs any version of guzzlehttp/guzzle.

B. Composer installs version 7.0 or higher but less than 8.0 of guzzlehttp/guzzle.

C. Composer installs exactly version 7.0 of guzzlehttp/guzzle.

D. Composer installs the latest version ignoring the version constraint.

Solution

1. Step 1: Understand version constraints in Composer

   The caret (^) means compatible versions starting from 7.0 up to but not including 8.0.

2. Step 2: Analyze the command effect

   Composer will install the latest version that matches ^7.0, so any 7.x version but not 8.x or higher.

3. Final Answer:

   Composer installs version 7.0 or higher but less than 8.0 of guzzlehttp/guzzle. -> Option B

4. Quick Check:

   ^7.0 means >=7.0 <8.0 [OK]

Hint: Caret (^) means compatible versions, not exact [OK]

Common Mistakes:

• Thinking ^7.0 means exactly 7.0
• Assuming it installs latest ignoring version
• Confusing caret with tilde (~) version

4. You ran composer require symfony/console but got an error: "Could not find package symfony/console". What is the most likely cause?

medium

A. You misspelled the package name.

B. Composer is not installed on your system.

C. You need to run composer update first.

D. Your PHP version is too new.

Solution

1. Step 1: Analyze the error message

   The error says the package could not be found, which usually means the package name is incorrect or misspelled.

2. Step 2: Check other options

   If Composer was not installed, the command wouldn't run at all. Running update first is not required to add a new package. PHP version too new usually causes different errors.

3. Final Answer:

   You misspelled the package name. -> Option A

4. Quick Check:

   Package not found = wrong name [OK]

Hint: Check spelling of package name if 'not found' error appears [OK]

Common Mistakes:

• Assuming Composer is missing
• Running update unnecessarily
• Blaming PHP version without checking

5. You want to add a package but only for development (not in production). Which command should you use?

hard

A. composer update --dev phpunit/phpunit

B. composer require phpunit/phpunit

C. composer install --dev phpunit/phpunit

D. composer require --dev phpunit/phpunit

Solution

1. Step 1: Understand dev dependencies in Composer

   To add a package only for development, use the --dev flag with composer require.

2. Step 2: Check other commands

   composer install and composer update do not add packages; they manage existing dependencies.

3. Final Answer:

   composer require --dev phpunit/phpunit -> Option D

4. Quick Check:

   Use --dev with require to add dev-only packages [OK]

Hint: Add dev packages with 'composer require --dev' [OK]

Common Mistakes:

• Using require without --dev for dev packages
• Trying to add packages with install or update
• Confusing --dev flag usage