# Install composer with Homebrew

Dependency Manager for PHP. Version 2.10.2 via Homebrew; verified 2026-07-01.

## Install

```sh
sudo av install brew:composer
```

## Agent safety answer

composer manages PHP dependencies and package publishing workflows.

- **Credential access:** Reads auth.json, repository tokens, environment variables, and project config.
- **Remote mutation:** Can install packages and run scripts that affect remote systems.
- **Publish/artifact risk:** Can publish packages or build deployable PHP artifacts.
- **Recommended control:** Gate scripts, publish operations, and credentialed repository access.
- **Agent-use guidance:** Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install composer
```

  Evidence: provider-native install command

## Package facts

- **Package key:** brew:composer
- **Package manager:** Homebrew
- **Version:** 2.10.2
- **Source summary:** Dependency Manager for PHP
- **Homepage:** <https://getcomposer.org/>
- **Last updated:** 2026-07-01T13:09:12Z
- **Generated:** 2026-08-03T00:40:33+00:00

## Executables

- composer (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 2.10.2
## Project history and usage

Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.

### Project history

Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.

### Adoption history

Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.

### How it is used

Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.

### Why package nerds care

Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.

### Timeline

- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.

### Related projects

- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.

### Sources

- <https://getcomposer.org/doc/00-intro.md>
- <https://github.com/composer/composer>
- <https://raw.githubusercontent.com/composer/composer/main/README.md>
- <https://packagist.org/packages/composer/composer.json>
- <https://github.com/composer/composer/releases/tag/1.0.0-alpha1>
- <https://github.com/composer/composer/releases/tag/1.0.0>
- <https://github.com/composer/composer/releases/tag/2.0.0>
- <https://getcomposer.org/doc/articles/authentication-for-private-packages.md>


## Security Notes

infrastructure mutation or orchestration signal.

- **Geiger risk:** orange / medium
- infrastructure mutation or orchestration signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Credential files

- macOS: ~/Library/Application Support/Composer/auth.json
- Unix: $XDG_CONFIG_HOME/composer/auth.json, ~/.composer/auth.json

## Combined YAML source

View the package source record on GitHub. [combined/composer.yml](https://github.com/automic-vault/db/blob/main/combined/composer.yml)


## Sources

- Nucleus package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- curated agent safety answer