Composer

Composer is a tool that downloads the code libraries a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. project needs and notes exactly which versions, so the project can be rebuilt the same way anywhere. Modern PHP software depends on it, and so do many WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. themes, plugins and custom builds.

What is Composer?

Composer is the package manager for PHP. It records the exact versions, so a project can be rebuilt in the same way on any server.

A PHP project rarely contains only its own code. It uses libraries for sending email, handling images, talking to payment providers and much more. Composer fetches them, mostly from a public catalogue called Packagist, and places them in a vendor folder. It also works out which versions fit together.

Two files do the work. composer.json lists what the project asks for and which versions are allowed, including which PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. the project supports. composer.lock records the exact versions that were installed. With the lock file, a developer, a test server and the live server all run identical packages.

Why exact versions matter

Libraries have their own weaknesses and their own release cycles. A site with up-to-date PHP and outdated libraries in the vendor folder still has a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. problem. The lock file makes it possible to see exactly what is installed.

Composer and your WordPress site

You may never run Composer yourself. Still, it affects you when a developer builds a custom themeA WordPress theme is a ready-made package that decides how your WordPress site looks and how its pages are laid out. Change the theme and the design changes. or pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop., when a shop or a larger plugin ships with a vendor folder, or when your site is set up with Composer from the start. In those cases, a PHP update is not only about PHP. The packages must support the new version too.

That is where updates break. A package that declares support only up to an older branch makes Composer refuse to install on a newer one. Another case is a package that works but uses features that are on the way out, see deprecationA deprecation is an early warning that a feature still works today but will be removed in a future PHP version, so code using it must be changed in time..

How to check your packages

If you or your developer have access to the project, run composer outdated to see which packages have newer releases, and composer audit to check for known security advisories. Do this on a copy of the project, not on the live site. If you do not have the project, ask the developer for the lock file and for the PHP versions it supports. A developer who works with Composer can answer both questions in a few minutes.

For a site without Composer, the same questions apply to each plugin: which PHP versions does it support, and when was it last updated?

When to act

Look at Composer when you plan a PHP update, when a developer builds something custom for you, or when an audit flags outdated libraries. Our PHP upgrade service includes checking whether the packages in your project support the target version. If a project has not been maintained for years, a PHP migration service can rebuild it on a modern foundation.