diff --git a/composer-schema.json b/composer-schema.json index 9d36b67..7bc19d0 100644 --- a/composer-schema.json +++ b/composer-schema.json @@ -13,10 +13,6 @@ "description": "Package type, either 'library' for common packages, 'composer-plugin' for plugins, 'metapackage' for empty packages, or a custom type ([a-z0-9-]+) defined by whatever project this package applies to.", "type": "string" }, - "target-dir": { - "description": "DEPRECATED: Forces the package to be installed into the given subdirectory path. This is used for autoloading PSR-0 packages that do not contain their full path. Use forward slashes for cross-platform compatibility.", - "type": "string" - }, "description": { "type": "string", "description": "Short package description." @@ -33,6 +29,10 @@ "description": "Homepage URL for the project.", "format": "uri" }, + "readme": { + "type": "string", + "description": "A relative path to the readme document." + }, "version": { "type": "string", "description": "Package version, see https://getcomposer.org/doc/04-schema.md#version for more info on valid schemes." @@ -108,6 +108,10 @@ "type": "object", "description": "Composer options.", "properties": { + "allow-plugins": { + "type": "object", + "description": "As of Composer 2.2.0, the 'allow-plugins' option adds a layer of security allowing you to restrict which Composer plugins are able to execute code during a Composer run. When a new plugin is first activated, which is not yet listed in the config option, Composer will print a warning. If you run Composer interactively it will prompt you to decide if you want to execute the plugin or not. Use this settings to allow only packages you trust to execute code. Set it to an object with package name patterns as keys. The values are 'true' to allow and 'false' to disallow while suppressing further warnings and prompts." + }, "process-timeout": { "type": "integer", "description": "The timeout in seconds for process executions, defaults to 300 (5mins)." @@ -461,6 +465,11 @@ "type": "string", "description": "URL to the documentation.", "format": "uri" + }, + "rss": { + "type": "string", + "description": "URL to the RSS feed.", + "format": "uri" } } }, @@ -474,6 +483,20 @@ "abandoned": { "type": ["boolean", "string"], "description": "Indicates whether this package has been abandoned, it can be boolean or a package name/URL pointing to a recommended alternative. Defaults to false." + }, + "funding": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "The type of funding, or the platform through which funding can be provided, e.g. patreon, opencollective, tidelift or github." + }, + "url": { + "type": "string", + "description": "URL to a website with details, and a way to fund the package.", + "format": "uri" + } + } } } } diff --git a/index.html b/index.html index 9d88288..9333a1d 100644 --- a/index.html +++ b/index.html @@ -18,7 +18,8 @@ "type": "

Package types are used for custom installation logic. If you have a package that needs some special logic, you can define a custom type. This could be a symfony-bundle, a wordpress-plugin or a typo3-module. These types will all be specific to certain projects, and they will need to provide an installer capable of installing packages of that type.

", "keywords": "An array of keywords that the package is related to. These can be used for searching and filtering.", "homepage": "An URL to the website of the project.", - "time": "Release date of the version.
Must be in YYYY-MM-DD, YYYY-MM-DD HH:MM:SS or YYYY-MM-DDTHH:MM:SSZ format.", + "readme": "A relative path to the readme document.", + "time": "Release date of the version.
Must be in YYYY-MM-DD or YYYY-MM-DD HH:MM:SS format.", "license": "The license of the package. This can be either a string or an array of strings.
The recommended notation for the most common licenses is (alphabetical):
Apache-2.0
BSD-2-Clause
BSD-3-Clause
BSD-4-Clause
GPL-2.0
GPL-2.0+
GPL-3.0
GPL-3.0+
LGPL-2.1
LGPL-2.1+
LGPL-3.0
LGPL-3.0+
MIT
For closed-source software, you may use proprietary as the license identifier.", "authors": "The authors of the package. This is an array of objects.", "authors-name": "The author's name. Usually his real name.", @@ -33,7 +34,11 @@ "support-irc" : "IRC channel for support, as irc://server/channel.", "support-source" : "URL to browse or download the sources.", "support-docs" : "URL to the documentation.", + "support-rss" : "URL to the RSS feed.", "support-chat" : "URL to the chat channel.", + "funding": "A list of URLs to provide funding to the package authors for maintenance and development of new functionality.", + "funding-type" : "The type of funding, or the platform through which funding can be provided, e.g. patreon, opencollective, tidelift or github.", + "funding-url" : "URL to a website with details, and a way to fund the package.", "require": "Lists packages required by this package. The package will not be installed unless those requirements can be met.
It take an object which maps package names to version constraints.
require and require-dev additionally support stability flags (root-only). These allow you to further restrict or expand the stability of a package beyond the scope of the minimum-stability setting. You can apply them to a constraint, or just apply them to an empty constraint if you want to allow unstable packages of a dependency's dependency for example.
require and require-dev additionally support explicit references (i.e. commit) for dev versions to make sure they are blocked to a given state, even when you run update. These only work if you explicitly require a dev version and append the reference with #<ref>.

Examples:


\"vendor/package\":  \"1.3.2\", 
// exactly 1.3.2
\"vendor/package\":  \">=1.3.2\", 
// anything above or equal to 1.3.2
\"vendor/package\":  \"<1.3.2\", 
// anything below 1.3.2
\"vendor/package\":  \"1.3.*\", 
// >=1.3.0 <1.4.0
\"vendor/package\":  \"~1.3.2\", 
// >=1.3.2 <1.4.0
\"vendor/package\":  \"~1.3\", 
// >=1.3.0 <2.0.0
\"vendor/package\":  \"^1.3.2\", 
// >=1.3.2 <2.0.0
\"vendor/package\":  \"^0.3.2\", 
// >=0.3.2 <0.4.0 // except if major version is 0 

>, <, >=, <= specify upper / lower bounds
* wildcard
~ allows last digit specified to go up
^ doesn't allow breaking changes
", "require-dev": "Lists packages required for developing this package, or running tests, etc. The dev requirements of the root package only will be installed if install or update is ran with --dev.
Packages listed here and their dependencies can not overrule the resolution found with the packages listed in require. This is even true if a different version of a package would be installable and solve the conflict. The reason is that install --dev produces the exact same state as just install, apart from the additional dev packages.
If you run into such a conflict, you can specify the conflicting package in the require section and require the right version number to resolve the conflict.

Examples:


\"vendor/package\":  \"1.3.2\", 
// exactly 1.3.2
\"vendor/package\":  \">=1.3.2\", 
// anything above or equal to 1.3.2
\"vendor/package\":  \"<1.3.2\", 
// anything below 1.3.2
\"vendor/package\":  \"1.3.*\", 
// >=1.3.0 <1.4.0
\"vendor/package\":  \"~1.3.2\", 
// >=1.3.2 <1.4.0
\"vendor/package\":  \"~1.3\", 
// >=1.3.0 <2.0.0
\"vendor/package\":  \"^1.3.2\", 
// >=1.3.2 <2.0.0
\"vendor/package\":  \"^0.3.2\", 
// >=0.3.2 <0.4.0 // except if major version is 0 

>, <, >=, <= specify upper / lower bounds
* wildcard
~ allows last digit specified to go up
^ doesn't allow breaking changes
", "conflict": "Lists packages that conflict with this version of this package. They will not be allowed to be installed together with your package.", @@ -42,85 +47,91 @@ "suggest": "Suggested packages that can enhance or work well with this package. These are just informational and are displayed after the package is installed, to give your users a hint that they could add more packages, even though they are not strictly required.
The format is like package links above, except that the values are free text and not version constraints.", "autoload": "Autoload mapping for a PHP autoloader.

Currently PSR-4 autoloading, PSR-0 autoloading, classmap generation and files are supported. PSR-4 is the recommended way though since it offers greater ease of use (no need to regenerate the autoloader when you add classes).

Under the psr-4 key you define a mapping from namespaces to paths, relative to the package root. When autoloading a class like Foo\\Bar\\Baz a namespace prefix Foo\\ pointing to a directory src/ means that the autoloader will look for a file named src/Bar/Baz.php and include it if present. Note that as opposed to the older PSR-0 style, the prefix (Foo\\) is not present in the file path.

Under the psr-0 key you define a mapping from namespaces to paths, relative to the package root. Note that this also supports the PEAR-style non-namespaced convention.", "autoload-dev": "Same as \"autoload\", but only considered in development mode.", - "target-dir": "DEPRECATED: Defines the installation target.

In case the package root is below the namespace declaration you cannot autoload properly. target-dir solves this problem.

An example is Symfony. There are individual packages for the components. The Yaml component is under Symfony\\Component\\Yaml. The package root is that Yaml directory. To make autoloading possible, we need to make sure that it is not installed into vendor/symfony/yaml, but instead into vendor/symfony/yaml/Symfony/Component/Yaml, so that the autoloader can load it from vendor/symfony/yaml.", "minimum-stability": "This defines the default behavior for filtering packages by stability. This defaults to stable, so if you rely on a dev package, you should specify it in your file to avoid surprises.
All versions of each package are checked for stability, and those that are less stable than the minimum-stability setting will be ignored when resolving your project dependencies. Specific changes to the stability requirements of a given package can be done in require or require-dev.Available options are dev, alpha, beta, RC, and stable.", - "repositories": "Custom package repositories to use.
By default composer just uses the packagist repository. By specifying repositories you can get packages from elsewhere.", - "repositories-composer": "The main repository type is the composer repository. It uses a single packages.json file that contains all of the package metadata.
This is also the repository type that packagist uses. To reference a composer repository, just supply the path before the packages.json file. In case of packagist, that file is located at /packages.json, so the URL of the repository would be packagist.org. For example.org/packages.json the repository URL would be example.org.
See the full documentation.", - "repositories-vcs": "VCS stands for version control system. This includes versioning systems like git, svn or hg. Composer has a repository type for installing packages from these systems.
See the full documentation.", - "repositories-pear": "It is possible to install packages from any PEAR channel by using the pear repository. Composer will prefix all package names with pear-{channelName}/ to avoid conflicts. All packages are also aliased with prefix pear-{channelAlias}/.
See the full documentation.", - "repositories-package": "If you want to use a project that does not support composer through any of the means above, you still can define the package yourself by using a package repository.
Basically, you define the same information that is included in the composer repository's packages.json, but only for a single package. Again, the minimum required fields are name, version, and either of dist or source.
See the full documentation.", - "repositories-artifact": "There are some cases, when there is no ability to have one of the previously mentioned repository types online, even the VCS one. Typical example could be cross-organisation library exchange through built artifacts. Of course, most of the times they are private. To simplify maintenance, one can simply use a repository of type artifact with a folder containing ZIP archives of those private packages.
See the full documentation.", - "repositories-path": "In addition to the artifact repository, you can use the path one, which allows you to depend on a relative directory. This can be especially useful when dealing with monolith repositories.
See the full documentation.", - "repositories-disabling-packagist": "You can disable the default Packagist.org repository by adding this to your composer.json.
See the full documentation.", + "repositories": "Custom package repositories to use.
By default composer just uses the packagist repository. By specifying repositories you can get packages from elsewhere.", "repositories-composer": "The main repository type is the composer repository. It uses a single packages.json file that contains all of the package metadata.
This is also the repository type that packagist uses. To reference a composer repository, just supply the path before the packages.json file. In case of packagist, that file is located at /packages.json, so the URL of the repository would be packagist.org. For example.org/packages.json the repository URL would be example.org.
See the full documentation.", + "repositories-vcs": "VCS stands for version control system. This includes versioning systems like git, svn or hg. Composer has a repository type for installing packages from these systems.
See the full documentation.", + "repositories-pear": "It is possible to install packages from any PEAR channel by using the pear repository. Composer will prefix all package names with pear-{channelName}/ to avoid conflicts. All packages are also aliased with prefix pear-{channelAlias}/.
See the full documentation.", + "repositories-package": "If you want to use a project that does not support composer through any of the means above, you still can define the package yourself by using a package repository.
Basically, you define the same information that is included in the composer repository's packages.json, but only for a single package. Again, the minimum required fields are name, version, and either of dist or source.
See the full documentation.", + "repositories-artifact": "There are some cases, when there is no ability to have one of the previously mentioned repository types online, even the VCS one. Typical example could be cross-organisation library exchange through built artifacts. Of course, most of the times they are private. To simplify maintenance, one can simply use a repository of type artifact with a folder containing ZIP archives of those private packages.
See the full documentation.", + "repositories-path": "In addition to the artifact repository, you can use the path one, which allows you to depend on a relative directory. This can be especially useful when dealing with monolith repositories.
See the full documentation.", + "repositories-disabling-packagist": "You can disable the default Packagist.org repository by adding this to your composer.json.
See the full documentation.", + "abandoned": "Indicated whether this package has been abandoned.
It can be boolean or a package name/URL pointing to a recommended alternative.", + "non-feature-branches": "A list of regex patterns of branch names that are non-numeric (e.g. latest or something), that will NOT be handled as feature branches. This is an array of strings.", "config": "A set of configuration options. It is only used for projects.", - "config-vendor-dir": "The location where all packages are installed.", - "config-bin-dir": "The location where all binaries are linked.", - "config-process-timeout": "The timeout in seconds for process executions, defaults to 300 (5mins).", - "config-notify-on-install": "Composer allows repositories to define a notification URL, so that they get notified whenever a package from that repository is installed. This option allows you to disable that behaviour.", - "config-github-protocols": "A list of protocols to use for github.com clones, in priority order.", - "config-use-include-path": "If true, the Composer autoloader will also look for classes in the PHP include path.", - "config-preferred-install": "Can be any of source, dist or auto. This option allows you to set the install method Composer will prefer to use.", - "config-github-oauth": "A list of domain names and oauth keys. Oauthtoken is used to access private repositories on github and to circumvent the low IP-based rate limiting of their API.", - "config-gitlab-oauth": "A list of domain names and oauth keys. Oauthtoken is used to access private repositories on gitlab.", - "config-github-domains": "A list of domains to use in github mode. This is used for GitHub Enterprise setups, defaults to [\"github.com\"].", - "config-gitlab-domains": "A list of domains to use in gitlab mode.", - "config-disable-tls": "If set to true all HTTPS URLs will be tried with HTTP instead and no network level encryption is performed. Enabling this is a security risk and is NOT recommended. The better way is to enable the php_openssl extension in php.ini.", - "config-cafile": "Location of Certificate Authority file on local filesystem. In PHP 5.6+ you should rather set this via openssl.cafile in php.ini, although PHP 5.6+ should be able to detect your system CA file automatically.", - "config-capath": "If cafile is not specified or if the certificate is not found there, the directory pointed to by capath is searched for a suitable certificate. capath must be a correctly hashed certificate directory.", - "config-http-basic": "A hash of domain name => {\"username\": \"...\", \"password\": \"...\"}.", - "config-platform": "Lets you fake platform packages (PHP and extensions) so that you can emulate a production env or define your target platform in the config.", - "config-store-auths": "What to do after prompting for authentication, one of: true (store), false (do not store) or \"prompt\" (ask every time), defaults to prompt.", - "config-cache-dir": "Stores all the caches used by composer. See also COMPOSER_HOME.", - "config-data-dir": "Defaults to C:\Users\User\AppData\Roaming\Composer on Windows, $XDG_DATA_HOME/composer on unix systems that follow the XDG Base Directory Specifications, and $home on other unix systems. Right now it is only used for storing past composer.phar files to be able to rollback to older versions.", - "config-cache-files-dir": "Stores the zip archives of packages.", - "config-cache-repo-dir": "Stores repository metadata for the composer type and the VCS repos of type svn, github and bitbucket.", - "config-cache-vcs-dir": "Stores VCS clones for loading VCS repository metadata for the git/hg types and to speed up installs.", - "config-cache-files-ttl": "Composer caches all dist (zip, tar, ...) packages that it downloads. Those are purged after six months of being unused by default. This option allows you to tweak this duration (in seconds) or disable it completely by setting it to 0.", - "config-cache-files-maxsize": "Composer caches all dist (zip, tar, ...) packages that it downloads. When the garbage collection is periodically ran, this is the maximum size the cache will be able to use. Older (less used) files will be removed first until the cache fits.", - "config-bin-compat": "Defaults to auto. Determines the compatibility of the binaries to be installed. If it is auto then Composer only installs .bat proxy files when on Windows. If set to full then both .bat files for Windows and scripts for Unix-based operating systems will be installed for each binary. This is mainly useful if you run Composer inside a linux VM but still want the .bat proxies available for use in the Windows host OS.", - "config-discard-changes": "Can be any of true, false or stash. This option allows you to set the default style of handling dirty updates when in non-interactive mode. true will always discard changes in vendors, while stash will try to stash and reapply. Use this for CI servers or deploy scripts if you tend to have modified vendors.", - "config-autoloader-suffix": "Optional string to be used as a suffix for the generated Composer autoloader. When null a random one will be generated.", - "config-optimize-autoloader": "Always optimize when dumping the autoloader.", - "config-prepend-autoloader": "If false, the composer autoloader will not be prepended to existing autoloaders, defaults to true.", - "config-sort-packages": "Defaults to false. If true, the require command keeps packages sorted by name in composer.json when adding a new package.", - "config-classmap-authoritative": "Defaults to false. If true, the Composer autoloader will only load classes from the classmap. Implies optimize-autoloader.", - "config-github-expose-hostname": "Defaults to true. If false, the OAuth tokens created to access the github API will have a date instead of the machine hostname.", - "config-archive-format": "Defaults to tar. Composer allows you to add a default archive format when the workflow needs to create a dedicated archiving format.", - "config-archive-dir": "Defaults to .. Composer allows you to add a default archive directory when the workflow needs to create a dedicated archiving format. Or for easier development between modules.", + "config-allow-plugins": "As of Composer 2.2.0, the allow-plugins option adds a layer of security allowing you to restrict which Composer plugins are able to execute code during a Composer run.

When a new plugin is first activated, which is not yet listed in the config option, Composer will print a warning. If you run Composer interactively it will prompt you to decide if you want to execute the plugin or not.

Use this settings to allow only packages you trust to execute code. Set it to an object with package name patterns as keys. The values are true to allow and false to disallow while suppressing further warnings and prompts.", + "config-vendor-dir": "The location where all packages are installed.", + "config-bin-dir": "The location where all binaries are linked.", + "config-process-timeout": "The timeout in seconds for process executions, defaults to 300 (5mins).", + "config-notify-on-install": "Composer allows repositories to define a notification URL, so that they get notified whenever a package from that repository is installed. This option allows you to disable that behaviour.", + "config-github-protocols": "A list of protocols to use for github.com clones, in priority order.", + "config-use-include-path": "If true, the Composer autoloader will also look for classes in the PHP include path.", + "config-preferred-install": "Can be any of source, dist or auto. This option allows you to set the install method Composer will prefer to use.", + "config-github-oauth": "A list of domain names and oauth keys. Oauthtoken is used to access private repositories on github and to circumvent the low IP-based rate limiting of their API.", + "config-gitlab-oauth": "A list of domain names and oauth keys. Oauthtoken is used to access private repositories on gitlab.", + "config-github-domains": "A list of domains to use in github mode. This is used for GitHub Enterprise setups, defaults to [\"github.com\"].", + "config-gitlab-domains": "A list of domains to use in gitlab mode.", + "config-disable-tls": "If set to true all HTTPS URLs will be tried with HTTP instead and no network level encryption is performed. Enabling this is a security risk and is NOT recommended. The better way is to enable the php_openssl extension in php.ini.", + "config-cafile": "Location of Certificate Authority file on local filesystem. In PHP 5.6+ you should rather set this via openssl.cafile in php.ini, although PHP 5.6+ should be able to detect your system CA file automatically.", + "config-capath": "If cafile is not specified or if the certificate is not found there, the directory pointed to by capath is searched for a suitable certificate. capath must be a correctly hashed certificate directory.", + "config-http-basic": "A hash of domain name => {\"username\": \"...\", \"password\": \"...\"}.", + "config-platform": "Lets you fake platform packages (PHP and extensions) so that you can emulate a production env or define your target platform in the config.", + "config-store-auths": "What to do after prompting for authentication, one of: true (store), false (do not store) or \"prompt\" (ask every time), defaults to prompt.", + "config-cache-dir": "Stores all the caches used by composer. See also COMPOSER_HOME.", + "config-data-dir": "Defaults to C:\Users\User\AppData\Roaming\Composer on Windows, $XDG_DATA_HOME/composer on unix systems that follow the XDG Base Directory Specifications, and $home on other unix systems. Right now it is only used for storing past composer.phar files to be able to rollback to older versions.", + "config-cache-files-dir": "Stores the zip archives of packages.", + "config-cache-repo-dir": "Stores repository metadata for the composer type and the VCS repos of type svn, github and bitbucket.", + "config-cache-vcs-dir": "Stores VCS clones for loading VCS repository metadata for the git/hg types and to speed up installs.", + "config-cache-files-ttl": "Composer caches all dist (zip, tar, ...) packages that it downloads. Those are purged after six months of being unused by default. This option allows you to tweak this duration (in seconds) or disable it completely by setting it to 0.", + "config-cache-files-maxsize": "Composer caches all dist (zip, tar, ...) packages that it downloads. When the garbage collection is periodically ran, this is the maximum size the cache will be able to use. Older (less used) files will be removed first until the cache fits.", + "config-bin-compat": "Defaults to auto. Determines the compatibility of the binaries to be installed. If it is auto then Composer only installs .bat proxy files when on Windows. If set to full then both .bat files for Windows and scripts for Unix-based operating systems will be installed for each binary. This is mainly useful if you run Composer inside a linux VM but still want the .bat proxies available for use in the Windows host OS.", + "config-discard-changes": "Can be any of true, false or stash. This option allows you to set the default style of handling dirty updates when in non-interactive mode. true will always discard changes in vendors, while stash will try to stash and reapply. Use this for CI servers or deploy scripts if you tend to have modified vendors.", + "config-autoloader-suffix": "Optional string to be used as a suffix for the generated Composer autoloader. When null a random one will be generated.", + "config-optimize-autoloader": "Always optimize when dumping the autoloader.", + "config-prepend-autoloader": "If false, the composer autoloader will not be prepended to existing autoloaders, defaults to true.", + "config-sort-packages": "Defaults to false. If true, the require command keeps packages sorted by name in composer.json when adding a new package.", + "config-classmap-authoritative": "Defaults to false. If true, the Composer autoloader will only load classes from the classmap. Implies optimize-autoloader.", + "config-github-expose-hostname": "Defaults to true. If false, the OAuth tokens created to access the github API will have a date instead of the machine hostname.", + "config-archive-format": "Defaults to tar. Composer allows you to add a default archive format when the workflow needs to create a dedicated archiving format.", + "config-archive-dir": "Defaults to .. Composer allows you to add a default archive directory when the workflow needs to create a dedicated archiving format. Or for easier development between modules.", "scripts": "Composer allows you to hook into various parts of the installation process through the use of scripts.
A script is a callback (defined as a static method) or a shell command that will be called when the event it listens on is triggered.
Let's take a look to the full list of Event Types.", "extra": "Arbitrary extra data for consumption by scripts.
This can be virtually anything. To access it from within a script event handler, you can do:
$extra = $event->getComposer()->getPackage()->getExtra();
", "bin": "A set of files that should be treated as binaries and symlinked into the bin-dir (from config).", "archive": "Options for creating package archives.
The example will include /dir/foo/bar/file, /foo/bar/baz, /file.php, /foo/my.test but it will exclude /foo/bar/any, /foo/baz, and /my.test.", "prefer-stable": "When this is enabled, Composer will prefer more stable packages over unstable ones when finding compatible stable packages is possible. If you require a dev version or only alphas are available for a package, those will still be selected granted that the minimum-stability allows for it.", "phar-about": "Short information about Composer.", - "phar-archive": "Create an archive of this composer package.", + "phar-archive": "This command is used to generate an archive for a given package in a given version. It can also be used to archive your entire project without excluded/ignored files.", + "phar-audit": "This command is used to audit the packages you have installed for possible security issues. It checks for and lists security vulnerability advisories according to the Packagist.org api.", "phar-browse": "Aliased to home, opens the package's repository URL or homepage in your browser.", - "phar-clear-cache": "Aliased to clearcache, clears composer's internal package cache.", - "phar-config": "Allows you to edit some basic composer settings in either the local composer.json file or the global config.json file.", - "phar-create-project": "Create new project from a package into given directory.", - "phar-depends": "Tell you which other packages depend on a certain package. You can specify which link types (require, require-dev) should be included in the listing. By default both are used.", - "phar-dump-autoload": "If you need to update the autoloader because of new classes in a classmap package for example, you can use \"dump-autoload\" to do that without having to go through an install or update.

Use --optimize to convert PSR-0/4 autoloading to classmap to get a faster autoloader. This is strongly recommended for production (you can get a 20% boost), but can take a bit of time to run so it is currently not done by default.

You can also use the dumpautoload alias.", - "phar-diagnose": "If you think you found a bug, or something is behaving strangely, you might want to run the diagnose command to perform automated checks for many common problems.", + "phar-bump": "The bump command increases the lower limit of your composer.json requirements to the currently installed versions.
This helps to ensure your dependencies do not accidentally get downgraded due to some other conflict, and can slightly improve dependency resolution performance as it limits the amount of package versions Composer has to look at.", + "phar-check-platform-reqs": "Checks that your PHP and extensions versions match the platform requirements of the installed packages. This can be used to verify that a production server has all the extensions needed to run a project after installing it for example.

Unlike update or install, this command will ignore config.platform settings and check the real platform packages so you can be certain you have the required platform dependencies.", + "phar-clear-cache": "Aliased to clearcache, deletes all content from Composer's cache directories.
Use --gc option to only run garbage collection.", + "phar-config": "The config command allows you to edit Composer config settings and repositories in either the local composer.json file or the global config.json file.", + "phar-create-project": "You can use Composer to create new projects from an existing package. This is the equivalent of doing a git clone/svn checkout followed by a composer install of the vendors.", + "phar-depends": "Tell you which other packages depend on a certain package. As with installation require-dev relationships are only considered for the root package.", + "phar-dump-autoload": "If you need to update the autoloader because of new classes in a classmap package for example, you can use dump-autoload to do that without having to go through an install or update.

Use --optimize to convert PSR-4 autoloading to classmap to get a faster autoloader. This is strongly recommended for production (you can get a 20% boost), but can take a bit of time to run so it is currently not done by default.

You can also use the dumpautoload alias.", + "phar-diagnose": "If you think you found a bug, or something is behaving strangely, you might want to run the diagnose command to perform automated checks for many common problems.", "phar-exec": "Execute a vendored binary/script.", - "phar-help": "Display help for all the other commands: composer help install.", + "phar-fund": "Discover how to help fund the maintenance of your dependencies.", "phar-global": "The global command allows you to run other commands like install, require or update as if you were running them from the COMPOSER_HOME directory.

This can be used to install CLI utilities globally and if you add $COMPOSER_HOME/vendor/bin to your $PATH environment variable.
$ composer global require friendsofphp/php-cs-fixer
Now the php-cs-fixer binary is available globally (assuming you adjusted your PATH).", + "phar-help": "Display help for a certain command: composer help install.", "phar-init": "Creates a basic composer.json file in current directory.

When you run the command it will interactively ask you to fill in the fields, while using some smart defaults.", - "phar-install": "Parses the composer.json file and downloads the needed dependencies.

The install command reads the composer.json file from the current directory, resolves the dependencies, and installs them into vendor.
If there is no composer.lock file, composer will create one after dependency resolution. The --no-scripts option is useful to bypass the configured pre and post scripts.

When a composer.lock file is present installs the exact package versions listed in composer.lock to ensure that they are consistent for everyone.

Committing composer.lock to VC is important because it will cause anyone who sets up the project to use the exact same versions of the dependencies that you are using.", + "phar-install": "The install command reads the composer.json file from the current directory, resolves the dependencies, and installs them into vendor.

When a composer.lock file is present installs the exact package versions listed in composer.lock to ensure that they are consistent for everyone.
If there is no composer.lock file, Composer will create one after dependency resolution.

Committing composer.lock to VC is important because it will cause anyone who sets up the project to use the exact same versions of the dependencies that you are using.

The --no-scripts option is useful to bypass the configured pre and post scripts.
The --no-dev option skips installing packages listed in require-dev and autoloader generation skips the autoload-dev rules.", "phar-info": "Show information about packages.", - "phar-licenses": "Show information about licenses of dependencies.", + "phar-licenses": "Lists the name, version and license of every package installed.", "phar-list": "Lists commands", "phar-outdated": "Shows a list of installed packages that have updates available (with colors!), including their current and latest versions.
", "phar-prohibits": "Tells you which packages are blocking a given package from being installed.", - "phar-remove": "Removes a package from the require or require-dev: remove vendor/package vendor/package2.", + "phar-reinstall": "Looks up installed packages by name, uninstalls them and reinstalls them.
This lets you do a clean install of a package if you messed with its files, or if you wish to change the installation type using --prefer-install.", + "phar-remove": "Removes a package from the composer.json file from the current directory: remove vendor/package vendor/package2.", "phar-require": "Adds required packages to your composer.json and installs them.

The require command adds new packages to the composer.json file from the current directory.
After adding/changing the requirements, the modified requirements will be installed or updated.", "phar-run-script": "Run the scripts manually, just give it the script name and optionally --no-dev to disable the dev mode.", - "phar-search": "Search for packages.

The search command allows you to search through the current project's package repositories. Usually, this will be just packagist. You simply pass it the terms you want to search for.", - "phar-self-update": "Updates composer.phar to the lastest version.

Running the self-update command could solve some problems and save you some time too.

You can also use the selfupdate alias.", - "phar-show": "List all of the available packages, you can use the show command like this show -v symfony/symfony to list the available versions.", + "phar-search": "The search command allows you to search through the current project's package repositories. Usually, this will be just packagist. You simply pass it the terms you want to search for.", + "phar-self-update": "To update Composer itself to the lastest version.

Running the self-update command could solve some problems and save you some time too.

You can also use the selfupdate alias.", + "phar-show": "List all of the available packages.

You can use the show command like this show \"symfony/*\" to list all packages available from symfony vendor.

If you want to see the details of a certain package, you can pass the package name composer show symfony/messenger.", "phar-status": "If you often need to modify the code of your dependencies and they are installed from source, the status command allows you to check if you have local changes in any of them.", "phar-suggests": "Lists all packages suggested by currently installed set of packages. You can optionally pass one or multiple package names in the format of vendor/package to limit output to suggestions made by those packages only.", - "phar-update": "Updates your dependencies to the latest version, and updates the composer.lock file.

In order to get the latest versions of the dependencies and to update the composer.lock file, you should use the update command.
This will resolve all dependencies of the project and write the exact versions into composer.lock.", - "phar-update-lock": "Sometimes, you might get this warning:
Warning: The lock file is not up to date with the latest changes in composer.json, you may be getting outdated dependencies, run update to update them.
This could happen after you manually edited the composer.json (add or change the description, authors, extra config, etc). Even if your changes are meaningless for Composer, it detects that the md5sum of the file changed so it warns you that these modifications are not currently taken into account in the composer.lock file.

So to suppress this warning, you can just run the update --lock command to update the lock file without upgrading any vendors.", + "phar-update": "Updates your dependencies to the latest version, and write to composer.lock file with exact version.

If you only want to update a few packages and not all, you can list them as composer update vendor-name/package-name.", + "phar-update-lock": "Sometimes, you might get this warning:
Warning: The lock file is not up to date with the latest changes in composer.json, you may be getting outdated dependencies, run update to update them.
This could happen after you manually edited the composer.json (add or change the description, authors, extra config, etc). Even if your changes are meaningless for Composer, it detects that the md5sum of the file changed so it warns you that these modifications are not currently taken into account in the composer.lock file.

So to suppress this warning, you can just run the update --lock command to update the lock file hash without upgrading any vendors.", "phar-validate": "Validates a composer.json.

You should always run the validate command before you commit your composer.json file, and before you tag a release. It will check if your composer.json is valid." }; @@ -249,7 +260,7 @@

Composer Cheat Sheet for developers

-

One line installer

+

One line installer for latest version

curl -sS https://getcomposer.org/installer | php
@@ -269,21 +280,25 @@

other commands

 $ composer about
 $ composer archive
+$ composer audit
 $ composer browse
+$ composer bump
+$ composer check-platform-reqs
 $ composer clear-cache
-$ composer config --list
-$ composer create-project symfony/standard-edition dir/
+$ composer config
+$ composer create-project symfony/skeleton dir/
 $ composer depends vendor-name/package-name
 $ composer diagnose
 $ composer exec
+$ composer fund
 $ composer global
 $ composer help
-$ composer info
 $ composer init
 $ composer licenses
 $ composer list
 $ composer outdated
 $ composer prohibits
+$ composer reinstall
 $ composer remove
 $ composer run-script
 $ composer search my keywords
@@ -304,6 +319,7 @@ 
composer.json file

     "type": "library",
     "keywords": ["logging", "cool", "awesome"],
     "homepage": "https://jolicode.com",
+    "readme": "./README.md",
     "time": "2012-12-21",
     "license": "MIT",
     "authors": [
@@ -328,8 +344,13 @@ 
composer.json file

         "irc": "irc://irc.freenode.org/composer",
         "source": "https://github.com/jolicode/jane",
         "docs": "https://github.com/jolicode/jane/wiki",
+        "rss": "https://feeds.feedburner.com/symfony/blog",
         "chat": "https://symfony-devs.slack.com/"
     },
+    "funding": {
+        "type": "other",
+        "url": "https://www.doctrine-project.org/sponsorship.html",
+    },
     "require": {
         "monolog/monolog": "1.0.*",
         "joli/ternel": "@dev",
@@ -368,11 +389,10 @@ 
composer.json file

         "files": ["src/MyLibrary/functions.php"]
     },
     "autoload-dev": {
-        "psr-0": {
-            "MyPackage\\Tests": "test/"
+        "psr-4": {
+            "MyPackage\\Tests\\": "tests/"
         }
     },
-    "target-dir": "Symfony/Component/Yaml",
     "minimum-stability": "stable",
     "repositories": [
         {
@@ -415,7 +435,10 @@ 
composer.json file

             "packagist.org": false
         }
     ],
-    "config": {
+    "config":
+        "allow-plugins": {
+            "symfony/flex": true
+        },
         "process-timeout": 300,
         "use-include-path": false,
         "preferred-install": "auto",
@@ -481,7 +504,11 @@ 
composer.json file

         "post-archive-cmd": "MyVendor\\MyClass::doSomething",
     },
     "extra": { "key": "value" },
-    "bin": ["./bin/toto"]
+    "bin": ["./bin/toto"],
+    "abandoned": "monolog/monolog",
+    "non-feature-branches": {
+        "non-feature-branches": ["latest-.*"]
+    }
 }