Development dependencies provide test runners, linters and tooling without belonging in production code.
What It Does
Development dependencies provide test runners, linters and tooling without belonging in production code. The following examples distinguish a normal use case, a boundary case and a practical application.
Requirements and Compatibility
Composer installed and a version-controlled composer.json; lockfile behavior differs between applications and libraries.
The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.
Example 1: Basic Behavior
Check Composer metadata and security advisories against your lock file.
composer validate --strict
composer audit --lockedThis is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.
Example 2: Another Case
Inspect direct dependency updates and installed platform packages before upgrading.
composer outdated --direct
composer show --platformThis is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.
Practical Example: Putting It to Use
Development-only packages belong under require-dev and are not necessarily installed in production.
<?php
$manifest = ['require' => ['php' => '^8.3'], 'require-dev' => ['phpunit/phpunit' => '^11']];
echo implode(', ', array_keys($manifest['require-dev']));Important Behavior and Edge Cases
Commit composer.lock for applications and keep development tools out of production deployments where suitable.
Comparison with Related Functions or Approaches
| Option | What it means in practice |
|---|---|
| Managing Dev Dependencies | Development dependencies provide test runners, linters and tooling without belonging in production code. |
| Related approach | Composer require --dev records packages under require-dev. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Ignoring the important boundary for Managing Dev Dependencies | Commit composer.lock for applications and keep development tools out of production deployments where suitable. |
| Assuming a related mechanism has the same behavior | Composer require --dev records packages under require-dev. |
Key Takeaways
- Development dependencies provide test runners, linters and tooling without belonging in production code.
- Commit composer.lock for applications and keep development tools out of production deployments where suitable.
- Composer require --dev records packages under require-dev.
Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.