PHPackages                             posternak/composer-file - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. posternak/composer-file

ActiveLibrary[Utility & Helpers](/categories/utility)

posternak/composer-file
=======================

The joyful way to programmatically read and edit composer.json and composer.lock in PHP — drop it into any script or automation.

1.0.0(1mo ago)01↓80%MITPHPPHP ^8.2CI passing

Since Jun 10Pushed 1mo agoCompare

[ Source](https://github.com/Androoha1/composer-file)[ Packagist](https://packagist.org/packages/posternak/composer-file)[ RSS](/packages/posternak-composer-file/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (3)Versions (2)Used By (0)

composer-file
=============

[](#composer-file)

[![CI](https://github.com/Androoha1/composer-file/actions/workflows/ci.yml/badge.svg)](https://github.com/Androoha1/composer-file/actions/workflows/ci.yml)[![Latest Version](https://camo.githubusercontent.com/41553dd77b290e2f8ecd74a50c24d382db018f4868fb6acc9583bac3d5635bee/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f706f737465726e616b2f636f6d706f7365722d66696c652e737667)](https://packagist.org/packages/posternak/composer-file)[![PHP Version](https://camo.githubusercontent.com/061cadf770b1091ce8c4614edda114e923bc89298c3db71cabfb5e13557c5fab/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f706f737465726e616b2f636f6d706f7365722d66696c652e737667)](https://packagist.org/packages/posternak/composer-file)[![License](https://camo.githubusercontent.com/9ca05f139d37cc258a7465d89594656d982fb01e4e824a7e18a0eedd263a1a01/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f706f737465726e616b2f636f6d706f7365722d66696c652e737667)](LICENSE)

The joyful way to programmatically read and edit `composer.json` and `composer.lock` in PHP — drop it into any script or automation.

Requirements
------------

[](#requirements)

- PHP 8.2+

Installation
------------

[](#installation)

```
composer require posternak/composer-file
```

Usage
-----

[](#usage)

The package ships two classes — one for each Composer file.

### `ComposerJsonFile` — read and edit `composer.json`

[](#composerjsonfile--read-and-edit-composerjson)

Given a `composer.json` like:

```
{
    "name": "acme/app",
    "require": {
        "php": "^8.2",
        "laravel/framework": "^12.8.1",
        "thecodingmachine/safe": "^3.0.2"
    },
    "require-dev": {
        "phpunit/phpunit": "^12.1.2"
    }
}
```

You can read, add, update, remove and iterate over its dependencies:

```
use Posternak\ComposerFile\ComposerJsonFile;

$file = new ComposerJsonFile('/path/to/composer.json');

// Read a constraint from either `require` or `require-dev`
$file->getPackageVersionConstraint('laravel/framework');   // "^12.8.1"
$file->getPackageVersionConstraint('phpunit/phpunit');     // "^12.1.2"
$file->getPackageVersionConstraint('vendor/missing');      // throws — guard with has() if unsure

// Update an existing constraint
$file->setPackageVersionConstraint('laravel/framework', '^12.9.0');

// Add a new dependency
$file->addPackage('symfony/console', '^7.2');
$file->addPackage('mockery/mockery', '^1.6', dev: true);

// Remove a dependency (no-op if it's not there)
$file->removePackage('thecodingmachine/safe');

// Iterate dependencies as a name => constraint map
foreach ($file->getRequire() as $name => $constraint) {
    echo "$name => $constraint\n";
}
foreach ($file->getRequireDev() as $name => $constraint) {
    // ...
}
```

A few rules to keep in mind:

- `setPackageVersionConstraint()` updates only — it throws if the package isn't already declared in `require` or `require-dev`. Use `addPackage()` for new ones.
- `addPackage()` adds only — it throws if the package is already declared anywhere. Use `setPackageVersionConstraint()` to change an existing constraint.
- `removePackage()` is idempotent — calling it on a package that isn't declared is a no-op.

`ComposerJsonFile` extends [`Posternak\JsonFile\JsonFile`](https://packagist.org/packages/posternak/json-file), so you also get the generic `has()`, `get()`, `set()`, `remove()` and `save()` methods on it — handy for poking at any other field in the file (autoload, scripts, config, …).

### `ComposerLockFile` — read installed versions from `composer.lock`

[](#composerlockfile--read-installed-versions-from-composerlock)

```
use Posternak\ComposerFile\ComposerLockFile;

$lock = new ComposerLockFile('/path/to/composer.lock');

// Installed version of a single package
$lock->getInstalledPackageVersion('laravel/framework');   // "v12.8.1"
$lock->getInstalledPackageVersion('vendor/missing');      // throws — package not installed

// Full lock entry — everything composer.lock records for the package
$lock->getPackageInfo('laravel/framework');
// => ["name" => "laravel/framework", "version" => "v12.8.1", "type" => "library", ...]

// Walk the lock file — all installed, just runtime, or just dev
$lock->getInstalledPackages();          // packages + packages-dev
$lock->getInstalledRuntimePackages();   // packages only
$lock->getInstalledDevPackages();       // packages-dev only
```

Both `getInstalledPackageVersion()` and `getPackageInfo()` throw `RuntimeException` if the package isn't installed.

Example: bump every package under a vendor prefix
-------------------------------------------------

[](#example-bump-every-package-under-a-vendor-prefix)

A short script that updates every `laravel/*` constraint in a project's `composer.json`:

```
use Posternak\ComposerFile\ComposerJsonFile;

$file = new ComposerJsonFile($argv[1] ?? __DIR__ . '/composer.json');

foreach ($file->getRequire() as $name => $constraint) {
    if (str_starts_with($name, 'laravel/')) {
        $file->setPackageVersionConstraint($name, '^12.9.0');
    }
}
```

The same shape works for any "for each package, do X" automation — audits, batch upgrades, CI lockstep checks across multiple repos.

License
-------

[](#license)

Released under the [MIT License](LICENSE).

###  Health Score

38

—

LowBetter than 83% of packages

Maintenance90

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity46

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

46d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/147425231?v=4)[androoha](/maintainers/androoha)[@Androoha](https://github.com/Androoha)

---

Top Contributors

[![Androoha1](https://avatars.githubusercontent.com/u/162342931?v=4)](https://github.com/Androoha1 "Androoha1 (26 commits)")

---

Tags

composerautomationcomposer-jsoncomposer-lock

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/posternak-composer-file/health.svg)

```
[![Health](https://phpackages.com/badges/posternak-composer-file/health.svg)](https://phpackages.com/packages/posternak-composer-file)
```

###  Alternatives

[jean85/pretty-package-versions

A library to get pretty versions strings of installed dependencies

1.3k315.9M84](/packages/jean85-pretty-package-versions)[ergebnis/composer-normalize

Provides a composer plugin for normalizing composer.json.

1.1k41.8M3.0k](/packages/ergebnis-composer-normalize)[icanhazstring/composer-unused

Show unused packages by scanning your code

1.7k7.9M327](/packages/icanhazstring-composer-unused)[bamarni/composer-bin-plugin

No conflicts for your bin dependencies

53124.4M1.1k](/packages/bamarni-composer-bin-plugin)[composer/metadata-minifier

Small utility library that handles metadata minification and expansion.

181123.3M26](/packages/composer-metadata-minifier)[shipmonk/composer-dependency-analyser

Fast detection of composer dependency issues (dead dependencies, shadow dependencies, misplaced dependencies)

6238.4M680](/packages/shipmonk-composer-dependency-analyser)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)