Managing PHP dependencies.
AVAILABILITY
Composer is available on most accounts with SSH access. Check with composer --version, or install it into your home directory if it is not present globally.
THE COMMON COMMANDS
Install dependencies from the lock file Update dependencies to newer versions within your constraints Require a new package Remove a package
ON PRODUCTION
Install from the lock file rather than updating. The lock file records exact versions that were tested; updating on production installs untested versions.
Use the no-development flag on production so development-only packages are excluded.
MEMORY LIMITS
Composer can exceed the PHP memory limit on large projects. Running it with an increased limit for that command usually resolves it.
If it still fails, run the resolution locally and commit the lock file, then install from it on the server.
WHAT NOT TO COMMIT
The vendor directory. Install it on the server instead. Committing it bloats the repository and causes merge conflicts.
Some hosts and workflows do commit it, which is a legitimate choice if server-side Composer is unavailable.
