2

I have been thrusted into the "wonderful" world of Composer because PHP libraries are starting to not offer an easy way to download and install the source code manually.

We have a very big system with decades worth of code so some inevitable things are slated to occur such as:

  • Preparing the server for a major PHP version upgrade
    • We'll need libraries in place for both PHP versions during the migration
  • Using new library version for current project and not breaking 30 previous projects which rely on old library version
  • Upgrade 30 previous projects to use new library version

I am going to pick on Google/Cloud since it has several dependencies such as guzzlehttp.

If I do:

cd /libraries/composer/google/cloud/0.179.0
composer require google/cloud:0.179.0

cd /libraries/composer/different_vendor/package/version
composer require different_vendor/package:version
# pretend this different vendor requires a version of guzzlehttp which is incompatible with google/cloud

cd /libraries/composer/guzzlehttp/guzzle/7.4.2    
composer require guzzlehttp/guzzle:7.4.2

Then would I have an issue writing code such as this?

<?php
require_once( '/libraries/composer/google/cloud/0.179.0/vendor/autoload.php' );
require_once( '/libraries/composer/different_vendor/package/version/vendor/autoload.php' );
require_once( '/libraries/composer/guzzlehttp/guzzle/7.4.2/vendor/autoload.php' );

If I have a need for google/cloud in one micro-app and guzzle in another then do I need to import google/cloud into the app that just needs guzzle?

I'm just trying to wrap my head around the benefits of Composer because all of the blogs mindlessly say "jUsT uSe ComPOsEr". I can see how composer is useful for one-off set-it-and-forget-it webapps which is presumably running on a dedicated server but that is far from our ecosystem; a website which serves public pages and various micro-apps requested by departments from a single domain.

I can definitely see why the code below would be a problem but I don't envision such a need ever occurring:

<?php
require_once( '/libraries/composer/google/cloud/0.178.0/vendor/autoload.php' );
require_once( '/libraries/composer/google/cloud/0.179.0/vendor/autoload.php' );
Improve this question

1 Answer 1

Reset to default
2

In short, no, you cannot use composer to install multiple versions of a dependency within the same project. The entire point of composer is to look at all the dependencies for a given project and install a version that will work given that combination of dependencies.

What I am gathering from your phrasing and examples is that you are managing a bank of dependencies separately from the actual projects. Composer is designed to maintain separate dependencies per project, not to manually manage dependencies in a shared folder used by all projects.

So, if you have 30 projects, you should have a separate composer.json file in the root of each project, and that will control your dependencies for that project, but each project itself could have different sets of dependencies. This, for example, allows you to migrate one project at a time to a new major php version and/or new server.

If you have libraries of code that you have created that you reuse across your own projects, then ideally you would turn your own shared library into a private composer package that you can then install as a dependency in the composer.json of each of your 30 projects that uses it. At this point, you can have separate versions of your own package, and the dependencies of things like the google api can vary between separate versions of your own package, and each of the 30 projects can then require the version of your package best suited for that project.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Thank you for this answer as it more clearly sheds a light on how the industry expects you to behave versus real-world usage. I strongly prefer the route of a centralized local repo of package versions so that I can write 30 micro-apps which each require PHPSpreadsheet but not install PHPSpreadsheet 30 times. I did some more testing and actually found zero issues with going the route of /libraries/composer/vendor/package/version and each app can just require whatever autoloads it needs.
Thank you for your comment; as someone who has been in your position, I was compelled to share my experience. Absolutely, your approach is quite usable, it is just not how composer was designed to work, for better or worse. Personally, once I embraced composer, (which was not an instant process, to be sure), I found the time it saved me, and the headaches it saved me from, and the portability and independence it granted each project, et. al., more than made up for the relatively trivial amounts of storage (especially by today's standards) used by multiple source copies.
I appreciate the insight. Maybe with time and comfort I might see that my current route is suboptimal but for now it is the nature of the beast which I contend with. Thanks again for you answer!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.