https://github.com/composer/composer
composer dependency-manager package-manager packages php
Score: 36.859585348933635
Last synced: about 5 hours ago
JSON representation
Repository metadata:
Dependency Manager for PHP
- Host: GitHub
- URL: https://github.com/composer/composer
- Owner: composer
- License: mit
- Created: 2011-06-08T08:53:00.000Z (over 15 years ago)
- Default Branch: main
- Last Pushed: 2026-11-05T19:13:51.000Z (2 days ago)
- Last Synced: 2026-11-05T20:59:39.534Z (1 day ago)
- Topics: composer, dependency-manager, package-manager, packages, php
- Language: PHP
- Homepage: https://getcomposer.org/
- Size: 29.9 MB
- Stars: 29,566
- Watchers: 587
- Forks: 4,864
- Open Issues: 155
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: .github/CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
-
Funding:
- Custom: https://packagist.com
- Github: composer
Owner metadata:
- Name: Composer
- Login: composer
- Email: support@packagist.org
- Kind: organization
- Description:
- Website: https://getcomposer.org/
- Location: Germany
- Twitter: packagist
- Company:
- Icon url: https://avatars.githubusercontent.com/u/837015?v=4
- Repositories: 21
- Last Synced at: 2026-11-01T13:09:30.422Z
- Profile URL: https://github.com/composer
GitHub Events
Total
- Commit comment event: 4
- Create event: 40
- Delete event: 30
- Discussion event: 8
- Fork event: 243
- Issue comment event: 1120
- Issues event: 351
- Pull request event: 310
- Pull request review comment event: 150
- Pull request review event: 183
- Push event: 304
- Release event: 12
- Watch event: 1021
- Total: 3776
Last Year
- Create event: 19
- Delete event: 16
- Discussion event: 8
- Fork event: 41
- Issue comment event: 141
- Issues event: 47
- Pull request event: 64
- Pull request review comment event: 19
- Pull request review event: 27
- Push event: 130
- Watch event: 183
- Total: 695
Committers metadata
Last synced: about 9 hours ago
Total Commits: 10,555
Total Committers: 1,265
Avg Commits per committer: 8.344
Development Distribution Score (DDS): 0.495
Commits in past year: 467
Committers in past year: 80
Avg Commits per committer in past year: 5.838
Development Distribution Score (DDS) in past year: 0.471
| Name | Commits | |
|---|---|---|
| Jordi Boggiano | j****o@s****e | 5328 |
| Nils Adermann | n****n@n****e | 554 |
| Rob Bast | r****t@g****m | 216 |
| Igor Wiedler | i****r@w****h | 116 |
| Stephan | g****x | 115 |
| johnstevenson | j****n@b****k | 86 |
| Niels Keurentjes | n****s@o****m | 85 |
| till | t****l@p****t | 72 |
| Christophe Coevoet | s****f@n****g | 70 |
| Markus Staab | m****b@r****e | 70 |
| dependabot[bot] | 4****] | 67 |
| Yanick Witschi | y****i@t****h | 60 |
| Martin Hasoň | m****n@g****m | 59 |
| Chris Smith | c****s@c****g | 58 |
| Beau Simensen | b****u@d****m | 54 |
| Nicolas Grekas | n****s@g****m | 45 |
| digitalkaoz | c****l@g****t | 44 |
| Andreas Möller | a****m@l****m | 43 |
| everzet | e****t@g****m | 39 |
| François Pluchino | f****o@o****m | 34 |
| Pádraic Brady | p****y@g****m | 33 |
| Jérôme Tamarelle | j****e@t****t | 30 |
| Stefan Grootscholten | s****n@g****m | 30 |
| jrfnl | j****l | 30 |
| matt-whittom | M****m@v****m | 29 |
| David Zuelke | d****e@g****m | 27 |
| Martin Herndl | m****n@h****g | 27 |
| PrinsFrank | 2****k | 27 |
| Andreas Hennings | a****s@d****t | 25 |
| Fabien Potencier | f****r@g****m | 23 |
| and 1235 more... | ||
Issue and Pull Request metadata
Last synced: about 9 hours ago
Total issues: 913
Total pull requests: 1,060
Average time to close issues: 5 months
Average time to close pull requests: about 1 month
Total issue authors: 714
Total pull request authors: 290
Average comments per issue: 5.42
Average comments per pull request: 1.71
Merged pull request: 722
Bot issues: 0
Bot pull requests: 90
Past year issues: 130
Past year pull requests: 349
Past year average time to close issues: about 1 month
Past year average time to close pull requests: 8 days
Past year issue authors: 100
Past year pull request authors: 94
Past year average comments per issue: 3.31
Past year average comments per pull request: 1.07
Past year merged pull request: 237
Past year bot issues: 0
Past year bot pull requests: 61
Top Issue Authors
- joachim-n (21)
- staabm (15)
- mvorisek (14)
- Seldaek (13)
- naderman (11)
- shyim (10)
- mxr576 (9)
- ro0NL (7)
- glaubinix (6)
- kkmuffme (6)
- alexander-schranz (6)
- stof (4)
- janedbal (4)
- vtsykun (4)
- bilogic (4)
Top Pull Request Authors
- Seldaek (233)
- dependabot[bot] (84)
- glaubinix (45)
- andreybolonin (24)
- PrinsFrank (18)
- Toflar (13)
- drupol (12)
- theoboldalex (12)
- mzhubail (12)
- jrfnl (12)
- johnstevenson (11)
- stof (11)
- asgrim (11)
- xabbuh (10)
- fredden (9)
Top Issue Labels
- Support (173)
- Bug (96)
- Stale (86)
- Feature (57)
- Good First Issue (13)
- Documentation (6)
- Question (5)
- Solver (3)
- Refactoring (2)
- Backport-2.2 (2)
- Needs Test (1)
Top Pull Request Labels
- Bug (124)
- dependencies (84)
- github_actions (80)
- Feature (79)
- Documentation (22)
- Refactoring (17)
- Backport-2.2 (9)
- Needs Work (7)
- Support (2)
- Solver (1)
- Needs Test (1)
Package metadata
- Total packages: 13
-
Total downloads:
- packagist: 213,748,865 total
- Total docker downloads: 57,082,643
- Total dependent packages: 2,642 (may contain duplicates)
- Total dependent repositories: 35,414 (may contain duplicates)
- Total versions: 471
- Total maintainers: 3
- Total advisories: 17
packagist.org: composer/composer
Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere.
- Homepage: https://getcomposer.org/
- Licenses: MIT
- Latest release: 2.11.1 (published 8 days ago)
- Last Synced: 2026-11-07T04:23:35.124Z (about 9 hours ago)
- Versions: 242
- Dependent Packages: 2,642
- Dependent Repositories: 35,414
- Downloads: 213,748,825 Total
- Docker Downloads: 57,082,643
-
Rankings:
- Stargazers count: 0.006%
- Forks count: 0.011%
- Dependent packages count: 0.016%
- Average: 0.044%
- Downloads: 0.046%
- Dependent repos count: 0.048%
- Docker downloads count: 0.137%
- Maintainers (2)
-
Funding:
- url: https://packagist.com: type: custom
- url: https://github.com/composer: type: github
-
Advisories:
- Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
- Composer arbitrary command execution via a malicious package's Perforce source URL
- Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
- Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
- Composer: Arbitrary file write outside vendor via malicious transitive package name
- Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
- Composer has a command injection via malicious perforce repository
- Composer has a command injection via malicious perforce reference
- Composer is vulnerable to ANSI sequence injection
- Composer has a command injection via malicious git branch name
- Composer has multiple command injections via malicious git/hg branch names
- Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php
- Composer Remote Code Execution vulnerability via web-accessible composer.phar
- Composer allows cache poisoning from other projects built on the same host
- Missing input validation can lead to command execution in composer
- Improper escaping of command arguments on Windows leading to command injection
- Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial
proxy.golang.org: github.com/Composer/composer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/Composer/composer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260924154220-0d9139e63c10 (published about 1 month ago)
- Last Synced: 2026-11-06T02:18:01.341Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.042%
- Average: 4.182%
- Dependent repos count: 4.323%
proxy.golang.org: github.com/coMpoSer/coMpoSer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/coMpoSer/coMpoSer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260828221403-2616959b478c (published 2 months ago)
- Last Synced: 2026-11-06T02:09:53.205Z (1 day ago)
- Versions: 2
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.262%
- Average: 4.408%
- Dependent repos count: 4.553%
proxy.golang.org: github.com/CoMPosEr/CoMPosEr
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/CoMPosEr/CoMPosEr#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260903112250-85ae0251528d (published 2 months ago)
- Last Synced: 2026-11-06T02:09:52.402Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.337%
- Average: 4.483%
- Dependent repos count: 4.629%
proxy.golang.org: github.com/cOmposer/cOmposer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/cOmposer/cOmposer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260828221403-2616959b478c (published 2 months ago)
- Last Synced: 2026-11-06T02:09:53.357Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.384%
- Average: 4.532%
- Dependent repos count: 4.679%
proxy.golang.org: github.com/composer/Composer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/composer/Composer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260903112250-85ae0251528d (published 2 months ago)
- Last Synced: 2026-11-06T02:18:00.921Z (1 day ago)
- Versions: 2
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.384%
- Average: 4.532%
- Dependent repos count: 4.679%
proxy.golang.org: github.com/coMposEr/coMposEr
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/coMposEr/coMposEr#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260903112250-85ae0251528d (published 2 months ago)
- Last Synced: 2026-11-06T02:09:52.558Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.397%
- Average: 4.545%
- Dependent repos count: 4.693%
proxy.golang.org: github.com/CompOser/CompOser
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/CompOser/CompOser#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20250919114159-3e38919bc9a2 (published about 1 year ago)
- Last Synced: 2026-11-06T02:17:59.430Z (1 day ago)
- Versions: 2
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.397%
- Average: 4.545%
- Dependent repos count: 4.693%
proxy.golang.org: github.com/Composer/Composer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/Composer/Composer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260903112250-85ae0251528d (published 2 months ago)
- Last Synced: 2026-11-06T02:17:59.059Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.421%
- Average: 4.57%
- Dependent repos count: 4.719%
proxy.golang.org: github.com/cOMPOSER/cOMPOSER
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/cOMPOSER/cOMPOSER#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20221027123929-e8d9087229bc (published about 4 years ago)
- Last Synced: 2026-11-06T02:09:53.312Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.432%
- Average: 4.581%
- Dependent repos count: 4.73%
proxy.golang.org: github.com/comPOser/comPOser
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/comPOser/comPOser#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260903112250-85ae0251528d (published 2 months ago)
- Last Synced: 2026-11-06T02:17:59.345Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.432%
- Average: 4.581%
- Dependent repos count: 4.73%
proxy.golang.org: github.com/composer/composer
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/composer/composer#section-documentation
- Licenses: mit
- Latest release: v0.0.0-20260812132411-6987fe5a4daa (published 3 months ago)
- Last Synced: 2026-11-06T02:17:59.130Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.482%
- Average: 4.633%
- Dependent repos count: 4.783%
packagist.org: lingfennan/protobuf
Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere.
- Homepage: https://getcomposer.org/
- Status: removed
- Licenses: MIT
- Latest release: 2.8.11 (published about 1 year ago)
- Last Synced: 2026-11-06T18:52:59.092Z (about 18 hours ago)
- Versions: 215
- Dependent Packages: 0
- Dependent Repositories: 0
- Downloads: 40 Total
-
Rankings:
- Stargazers count: 0.006%
- Forks count: 0.007%
- Dependent packages count: 19.102%
- Average: 21.152%
- Dependent repos count: 33.452%
- Downloads: 53.194%
- Maintainers (1)
-
Funding:
- url: https://packagist.com: type: custom
- url: https://github.com/composer: type: github
Dependencies
composer.json
packagist
- phpstan/phpstan ^1.4.1 development
- phpstan/phpstan-deprecation-rules ^1 development
- phpstan/phpstan-phpunit ^1.0 development
- phpstan/phpstan-strict-rules ^1 development
- phpstan/phpstan-symfony ^1.1 development
- symfony/phpunit-bridge ^6.0 development
- composer/ca-bundle ^1.0
- composer/class-map-generator ^1.0
- composer/metadata-minifier ^1.0
- composer/pcre ^2 || ^3
- composer/semver ^3.0
- composer/spdx-licenses ^1.5.7
- composer/xdebug-handler ^2.0.2 || ^3.0.3
- justinrainbow/json-schema ^5.2.11
- php ^7.2.5 || ^8.0
- psr/log ^1.0 || ^2.0 || ^3.0
- react/promise ^2.8
- seld/jsonlint ^1.4
- seld/phar-utils ^1.2
- symfony/console ^5.4.7 || ^6.0.7
- symfony/filesystem ^5.4 || ^6.0
- symfony/finder ^5.4 || ^6.0
- symfony/polyfill-php73 ^1.24
- symfony/polyfill-php80 ^1.24
- symfony/process ^5.4 || ^6.0
composer.lock
packagist
- phpstan/phpstan 1.10.50 development
- phpstan/phpstan-deprecation-rules 1.1.4 development
- phpstan/phpstan-phpunit 1.3.15 development
- phpstan/phpstan-strict-rules 1.5.2 development
- phpstan/phpstan-symfony 1.3.5 development
- symfony/phpunit-bridge v7.0.1 development
- composer/ca-bundle 1.3.7
- composer/class-map-generator 1.1.0
- composer/metadata-minifier 1.0.0
- composer/pcre 2.1.1
- composer/semver 3.4.0
- composer/spdx-licenses 1.5.8
- composer/xdebug-handler 3.0.3
- justinrainbow/json-schema v5.2.13
- psr/container 1.1.1
- psr/log 1.1.4
- react/promise v3.1.0
- seld/jsonlint 1.10.0
- seld/phar-utils 1.2.1
- seld/signal-handler 2.0.2
- symfony/console v5.4.32
- symfony/deprecation-contracts v2.5.2
- symfony/filesystem v5.4.25
- symfony/finder v5.4.27
- symfony/polyfill-ctype v1.28.0
- symfony/polyfill-intl-grapheme v1.28.0
- symfony/polyfill-intl-normalizer v1.28.0
- symfony/polyfill-mbstring v1.28.0
- symfony/polyfill-php73 v1.28.0
- symfony/polyfill-php80 v1.28.0
- symfony/polyfill-php81 v1.28.0
- symfony/process v5.4.28
- symfony/service-contracts v2.5.2
- symfony/string v5.4.32