Introduction
As you may know, Composer is a PHP dependency manager that manages the versions of the PHP libraries, tools & frameworks that we utilise in our applications. Everyone understands the working of composer.json file very well, which is used to list the versions of your PHP dependencies that you wish to install. But in process of fetching and installing the dependencies composer generates a mysterious composer.lock file alongside the vendor directory.
If we take Laravel for instance, its composer.json file looks like this in the beginning.
{
"name": "laravel/laravel",
"description": "The Laravel Framework.",
"keywords": ["framework", "laravel"],
"license": "MIT",
"type": "project",
"require": {
"php": ">=7.0.0",
"fideloper/proxy": "~3.3",
"laravel/framework": "5.5.*",
"laravel/tinker": "~1.0",
},
"require-dev": {
"filp/whoops": "~2.0",
"fzaninotto/faker": "~1.4",
"mockery/mockery": "~1.0",
"phpunit/phpunit": "~6.0"
},
"autoload": {
"classmap": [
"database/seeds",
"database/factories"
],
"psr-4": {
"App\\": "app/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"extra": {
"laravel": {
"dont-discover": [
]
}
},
"scripts": {
"post-root-package-install": [
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
],
"post-create-project-cmd": [
"@php artisan key:generate"
],
"post-autoload-dump": [
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
"@php artisan package:discover"
]
},
"config": {
"preferred-install": "dist",
"sort-packages": true,
"optimize-autoloader": true
}
}
The most important part here is the require block which contains all of the dependencies
{
"require": {
"php": ">=7.0.0",
"fideloper/proxy": "~3.3",
"laravel/framework": "5.5.*",
"laravel/tinker": "~1.0",
}
}
If you notice, it only contains the packages along with their version numbers. Or if we aren't sure of the proper version, we just pass a (*) wildcard, which will play the trick for us. Its not really self-explanatory. We do not have any idea what these packages do and what effect it will bring to our application. Its kind of a incomplete guide for most of us who'd want to dig in deeper regarding every single detail of the application.
Generating the composer.lock file
When we run composer install inside our project directory, composer generates the composer.lock file for us. And if you look inside of it, you'd surprised to see that its pretty big. But if you look clearly, this file holds the complete record of every dependency & all of the sub dependencies installed with each dependency, which is being installed by composer.json.
Let's have a look at one of the package information inside composer.lock file
"packages": [
{
"name": "ddctd143/google-translate",
"version": "dev-master",
"source": {
"type": "git",
"url": "https://github.com/ddctd143/google-translate.git",
"reference": "b2a584e251976bdd62239ac14a00489963000b0f"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/ddctd143/google-translate/zipball/b2a584e251976bdd62239ac14a00489963000b0f",
"reference": "b2a584e251976bdd62239ac14a00489963000b0f",
"shasum": ""
},
"require": {
"guzzlehttp/guzzle": "^6.1",
"php": ">=5.5.9"
},
"require-dev": {
"phpunit/phpunit": "^5.2"
},
"type": "library",
"autoload": {
"psr-4": {
"Dedicated\\GoogleTranslate\\": "src/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Arturs Terehovics",
"email": "[email protected]"
}
],
"description": "Free Laravel package for Paid Google Translate REST API",
"homepage": "http://github.com/ddctd143/google-translate",
"keywords": [
"google",
"laravel",
"php",
"translate"
],
"time": "2017-05-01T23:22:22+00:00"
},
]
Above is the sample package, which contains every single detail associated with the google translator package. The name, the version, commit reference string, sub dependencies, license etc.
Pretty useful right?
Updating your composer.lock file
composer.lock file generates in result of composer install command. Whenever you need to add another package, you can run either composer update or composer install to update your composer.lock file along with the updated packages versions.
Conclusion
I hope this somehow clears the understanding regarding the mystery of composer.lock file. If not leave us a comment below to ask any query. You can also follow us on Twitter.
More Readings
