Using libraries.
WHAT COMPOSER IS
The standard tool for managing PHP dependencies.
WHAT IT DOES
Installs libraries and their dependencies Records exact versions Provides automatic class loading
WHAT TWO FILES MATTER
One declaring what you require One recording exactly what was installed
WHAT TO COMMIT
Both.
WHY THE SECOND
It guarantees the same versions everywhere.
WHAT NOT TO COMMIT
The installed dependencies directory.
WHY
It is large and reproducible from the lock file.
WHAT TO RUN IN PRODUCTION
Installation from the lock file, with development dependencies excluded and the class loader optimised.
WHAT TO CHECK BEFORE ADDING A LIBRARY
Whether it is maintained How widely used it is What it depends on Whether you need it
WHAT TO REVIEW PERIODICALLY
Dependencies with security advisories Dependencies no longer maintained Dependencies you no longer use
WHAT TO AVOID
Updating everything the day before a deadline.
