How composer is put together
Composer is the de-facto dependency manager for PHP, implemented as a CLI application in PHP (Symfony Console-based). It resolves package dependencies via a SAT-style solver over package pools built from Packagist or custom repositories, downloads packages through pluggable downloaders (zip/tar/git/hg/svn/fossil/perforce), installs them into vendor/, generates autoloaders, and writes a lockfile. Data flows from composer.json/repository metadata through the DependencyResolver into the Installer/InstallationManager, which delegates to downloaders and installers, with an EventDispatcher running user-defined scripts and a PluginManager loading third-party plugins.
Languages
Frameworks
Infrastructure
Major components
Console/Application & Command layer
Symfony Console CLI exposing commands like install, update, require, audit, self-update under src/Composer/Command.
DependencyResolver
SAT-like solver (Solver, Pool, PoolBuilder, RuleSet, Transaction) that computes which package versions satisfy constraints.
Downloader subsystem
Fetches and extracts packages via FileDownloader, ZipDownloader, GitDownloader, SvnDownloader, HgDownloader, PerforceDownloader, etc.
Installer subsystem
InstallationManager plus LibraryInstaller/BinaryInstaller/PluginInstaller place packages, vendor binaries, and plugins on disk.
Autoload
AutoloadGenerator, ClassLoader, and ClassMapGenerator produce PSR-4/PSR-0/classmap autoloaders for installed packages.
Advisory & FilterList
Auditor and FilterListApiClient query security advisory APIs to audit dependencies for known vulnerabilities.
Plugin system
PluginManager loads and executes third-party composer plugins and dispatches plugin lifecycle events (PreFileDownloadEvent, etc.).
Config/Json/IO foundation
Config, Factory, JsonFile/JsonManipulator, and IO classes handle configuration, composer.json editing, and console input/output including credentials.
A short week mixing a GitLab host-matching fix with friendlier download error messages.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A short week mixing a GitLab host-matching fix with friendlier download error messages.
Week of 2026-08-10
A single small cleanup replacing an outdated PHP function.
Week of 2026-08-03
Mostly maintenance: two automation bumps plus updated plugin API docs.
Week of 2026-07-27
A busier week with improved download-failure logging, a sponsors section, and several tooling updates.
Week of 2026-07-20
One targeted improvement making package policy blocks easier to understand.
Over the past five weeks, Composer's development focused on polishing error messages and fixing small bugs, particularly around how download failures and URL handling are reported to users. Routine maintenance dominated much of the activity, with several automated tooling updates (GitHub Actions bumps) and documentation refreshes like the new plugin API version notes and a sponsors section in the README. A couple of user-facing improvements stood out: better visibility into which policy source blocked a package version, and clearer error messages that now include the failed URL or filename.
Week by week
2026-08-17A short week mixing a GitLab host-matching fix with friendlier download error messages.latest4 changes
Fix
Fixed GitLab domain matching for URLs
The code that checks whether a URL belongs to a configured GitLab domain was matching too loosely, so it now compares hosts correctly.
Fix
Failed URL shown in size-limit errors
When a download fails because it exceeds the maximum file size or content length, the error message now includes the exact URL that failed.
Chore
Updated attestation tooling
The automated build-security action was bumped from version 4.2.1 to 4.2.2 as routine upkeep.
Chore
Updated security-scanning action
The zizmor security-analysis workflow was bumped from 0.6.1 to 0.6.2 to keep CI tooling current.
2026-08-10A single small cleanup replacing an outdated PHP function.1 change
Refactor
Replaced deprecated object-hash function
The codebase stopped using the outdated spl_object_hash function in favor of its modern replacement spl_object_id, resolving issue #13027.
2026-08-03Mostly maintenance: two automation bumps plus updated plugin API docs.3 changes
Chore
Updated attestation tooling
The actions/attest workflow moved from 4.2.0 to 4.2.1 as part of regular dependency upkeep.
Chore
Updated stale-issue automation
The bot that manages stale issues and pull requests was upgraded from 10.4.0 to 11.0.0.
Docs
Documented plugin API 2.9.0
Documentation now references composer-plugin-api version 2.9.0 so plugin authors see the current supported API.
2026-07-27A busier week with improved download-failure logging, a sponsors section, and several tooling updates.5 changes
Feature
Better logging of failed downloads
When a file download fails, log messages now include the filename so users can more easily tell what went wrong.
Docs
Added sponsors to README
The project's README now includes a section acknowledging its sponsors.
Chore
Updated checkout action
The actions/checkout workflow used in CI was bumped from 7.0.0 to 7.0.1.
Chore
Updated zizmor twice
The zizmor security-action received two upgrades over the week, moving from 0.5.7 up through 0.6.0 to 0.6.1.
Chore
Updated attestation tooling
The actions/attest workflow was bumped from 4.1.1 to 4.2.0.
2026-07-20One targeted improvement making package policy blocks easier to understand.1 change
Feature
Show policy source blocking a package
When a package version is filtered out by policies, users can now see exactly which source applied the block, making restrictions easier to diagnose.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required