Skip to content

Composer and Magento 2

Composer, as defined in the official docs, “is a tool for dependency management in PHP. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you.”  So instead of needing some PHP library and putting in a directory, setting everything up, and requiring it where needed, you can automatically do this via a JSON setup file.

Magento 2 heavily relies on composer (though you can avoid it) through several repositories. Consider the Magento 2 install via composer.  Composer itself is pre-installed on MageMojo servers and then you run a command like this:

composer create-project --repository-url= magento/project-community-edition

Before diving into the JSON file itself that comes with Magento 2, you should understand this command.  First composer is called, which then creates a project. The complete page on this is here, but it will pull an existing package.  The repository-url is an argument for create-project and goes to the Magento repo URL to search for the package name that follows which is magento/project-community-edition , the final period symbol specifies the path to create the project.

This is a composer way of doing a git checkout/clone of a repo, then it runs the composer.json file to get everything else along with the package.


After the initlal pull, composer uses the composer.json to get all the packages. If you open the Magento 2.1 composer.json file, there is quite a lot. Below is the current composer.json for Magento 2.1.1

    "name": "magento/project-community-edition",
    "description": "eCommerce Platform for Growth (Community Edition)",
    "type": "project",
    "version": "2.1.1",
    "license": [
    "require": {
        "magento/product-community-edition": "2.1.1",
        "composer/composer": "@alpha"
    "require-dev": {
        "phpunit/phpunit": "4.1.0",
        "squizlabs/php_codesniffer": "1.5.3",
        "phpmd/phpmd": "@stable",
        "pdepend/pdepend": "2.2.2",
        "fabpot/php-cs-fixer": "~1.2",
        "lusitanian/oauth": "~0.3 <=0.7.0",
        "sebastian/phpcpd": "2.0.0"
    "config": {
        "use-include-path": true
    "autoload": {
        "psr-4": {
            "Magento\\Framework\\": "lib/internal/Magento/Framework/",
            "Magento\\Setup\\": "setup/src/Magento/Setup/",
            "Magento\\": "app/code/Magento/"
        "psr-0": {
            "": "app/code/"
        "files": [
    "autoload-dev": {
        "psr-4": {
            "Magento\\Sniffs\\": "dev/tests/static/framework/Magento/Sniffs/",
            "Magento\\Tools\\": "dev/tools/Magento/Tools/",
            "Magento\\Tools\\Sanity\\": "dev/build/publication/sanity/Magento/Tools/Sanity/",
            "Magento\\TestFramework\\Inspection\\": "dev/tests/static/framework/Magento/TestFramework/Inspection/",
            "Magento\\TestFramework\\Utility\\": "dev/tests/static/framework/Magento/TestFramework/Utility/"
    "minimum-stability": "alpha",
    "prefer-stable": true,
    "repositories": [
            "type": "composer",
            "url": ""
    "extra": {
        "magento-force": "override"

Parts of this are obvious, there is a name and description and other meta-data to identify the project.  The require section is where the magic starts to happen. This specifies the packages to be added to the project from the repositories listed later.  require-dev is also installed but can be excluded in the initial install with the proper flag (–no-dev).  The packages for phpunit and other testing tools are in the vendor directory in Magento 2.  The psr-4 and psr-0 terms are different autoloading specifications in PHP.

Config will check for other items within the path to add to the autoloader (see here )

Autoloading is another useful feature of composer, and is worthy of a separate discussion.  Based on the autoload section, composer will generate a file named autoload.php in the vendor directory.  This ties into the bootstrap process you see in index.php under Magento 2.  Long story short, it automatically includes needed code throughout your store so it can work without having to manually add a lot of requirements etc throughout the code.

Minimum-stability and prefer-stable would only change if you willfully wanted to use a dev or other branch of Magento 2. For the stable releases this will not change and it is what would be used under production circumstances. A developer interested in contributing to Magento 2 would use this.

Repositories are the code sources, this was also part of the initial pull when the Magento 2 install began.

Do I have to use composer with Magento 2?

No, but you should.  Modules and themes can all integrate composer to package them together for easy deployment. The alternative is manually (or scripting out) bespoke or custom deployments for everything yo do or relying on git to manage sub-packages in Magento 2. With composer, you can quickly recreate a Magento 2 site anywhere minus the specific product data etc in the database within minutes.