Deploy a PHP application from a committed composer.lock using composer install, not a production-time unrestricted dependency upgrade.
What It Does
Production deployments should keep development packages out and use a lock file. Verify production-only platform requirements. Install the exact locked versions and verify the target PHP runtime. Verify production-only platform requirements.
Requirements and Compatibility
Use a supported PHP runtime and install any third-party tool or extension explicitly shown in the examples. Commands should be run from the project root unless stated otherwise.
Syntax, Inputs and Results
The examples separate configuration, the smallest working operation and a realistic follow-up task. Adapt file paths and dependency versions to your own project.
Example 1: Basic Use
Production deployments should keep development packages out and use a lock file. Verify production-only platform requirements.
composer install --no-dev --classmap-authoritative --no-interaction
composer audit --no-dev
composer check-platform-reqs --no-devExample 2: Another Case
Install the exact locked versions and verify the target PHP runtime. Verify production-only platform requirements.
composer install --no-interaction --prefer-dist
composer check-platform-reqs
composer check-platform-reqs --no-devPractical Example
Distinguish advisories for locked dependencies from available upstream updates. Verify production-only platform requirements.
composer audit --locked
composer outdated --direct
composer check-platform-reqs --no-devFor production, apply the compatibility and edge-case limits described below.
Important Behavior and Edge Cases
Use the checked-in lock file for reproducible application builds.
Comparison with Related Functions and Tools
| Subject | Key difference |
|---|---|
| composer install vs composer update | install follows composer.lock; update resolves new versions and updates the lock file. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Treating a version range as a fixed installed version | Commit composer.lock for applications and run composer install in deployment. |
| Skipping the prerequisite of this specific workflow | Install or configure the named tool and confirm the example can actually run. |
| Ignoring edge conditions | Use the checked-in lock file for reproducible application builds. |
Key Takeaways
- Deploy a PHP application from a committed composer.lock using composer install, not a production-time unrestricted dependency upgrade.
- Use the checked-in lock file for reproducible application builds.
- Keep application configuration, source code and validation tests under version control.
Use these examples as a starting point, then validate the result with the actual PHP build, dependencies and inputs used by your application.