📦 Dependencies

This page covers methods in pkg/composer related to project dependency installation, updating, and autoloading, defined in dependencies.go and additional_methods.go. They correspond to composer's install, update, dump-autoload, suggests, fund, audit, and other subcommands.

🎯 When to Use

📥 First dependency install after cloning a project → Install
🔄 Upgrade dependencies to latest versions → Update
⚡ Regenerate autoloader (after adding new classes) → DumpAutoload
🧪 Want to dry-run an install/update without actual changes → InstallDryRun / UpdateDryRun
🏭 Production deployment needs extreme optimization → InstallWithClassmapAuthoritative / InstallWithAPCu
🔒 Only fix composer.lock hash without touching package versions → UpdateWithLock

📋 Method Overview

The table below lists all dependency management related methods. Variants with WithOptions accept map[string]string to customize composer long options; variants with DryRun only simulate without actual execution.

Method	Signature Summary	Equivalent Command
📥 `Install`	`Install(noDev bool, optimize bool) error`	`composer install [--no-dev] [--optimize-autoloader]`
`InstallWithOptions`	`InstallWithOptions(options map[string]string) error`	`composer install [options]`
`InstallWithPreferSource`	`InstallWithPreferSource() error`	`composer install --prefer-source`
`InstallWithPreferDist`	`InstallWithPreferDist() error`	`composer install --prefer-dist`
`InstallNoScripts`	`InstallNoScripts() error`	`composer install --no-scripts`
`InstallWithClassmapAuthoritative`	`InstallWithClassmapAuthoritative() error`	`composer install --classmap-authoritative`
`InstallWithAPCu`	`InstallWithAPCu() error`	`composer install --apcu-autoloader`
`InstallNoDev`	`InstallNoDev() error`	`composer install --no-dev`
`InstallWithWorkingDir`	`InstallWithWorkingDir(workingDir string, noDev bool, optimize bool) error`	Execute `install` in specified directory
🧪 `InstallDryRun`	`InstallDryRun() (string, error)`	`composer install --dry-run`
🔄 `Update`	`Update(packages []string, noDev bool) error`	`composer update [--no-dev] [packages...]`
`UpdateWithOptions`	`UpdateWithOptions(packages []string, options map[string]string) error`	`composer update [options] [packages...]`
`UpdateWithPreferSource`	`UpdateWithPreferSource(packages []string) error`	`composer update --prefer-source [packages...]`
`UpdateWithPreferDist`	`UpdateWithPreferDist(packages []string) error`	`composer update --prefer-dist [packages...]`
`UpdateNoScripts`	`UpdateNoScripts(packages []string) error`	`composer update --no-scripts [packages...]`
`UpdateNoDev`	`UpdateNoDev(packages []string) error`	`composer update --no-dev [packages...]`
`UpdateWithDependencies`	`UpdateWithDependencies(packages []string) error`	`composer update --with-dependencies [packages...]`
`UpdateWithAllDependencies`	`UpdateWithAllDependencies(packages []string) error`	`composer update --with-all-dependencies [packages...]`
`UpdateWithLock`	`UpdateWithLock() error`	`composer update --lock`
🧪 `UpdateDryRun`	`UpdateDryRun(packages []string) (string, error)`	`composer update --dry-run [packages...]`
⚡ `DumpAutoload`	`DumpAutoload(optimize bool) error`	`composer dump-autoload [--optimize]`
`DumpAutoloadWithOptions`	`DumpAutoloadWithOptions(options map[string]string) error`	`composer dump-autoload [options]`
🔍 `CheckDependencies`	`CheckDependencies() (string, error)`	`composer check`
💡 `Suggests`	`Suggests() error`	`composer suggests`
💰 `FundPackages`	`FundPackages() (string, error)`	`composer fund`
🔒 `RunAudit`	`RunAudit() (string, error)`	`composer audit`

Options Map Convention

For map[string]string received by *WithOptions, keys are composer long option names (without --), and values that are empty strings "" are treated as pure flag options (only --key is added), otherwise --key=value is generated. For example, {"no-dev": "", "prefer-dist": ""} becomes --no-dev --prefer-dist.

📥 `Install`

Install all project dependencies based on composer.json. This is the most commonly used method.

Signature

func (c *Composer) Install(noDev bool, optimize bool) error

Parameters

Parameter	Type	Description
`noDev`	`bool`	`true` adds `--no-dev`, not installing dev dependencies from `require-dev`
`optimize`	`bool`	`true` adds `--optimize-autoloader`, optimizing the autoloader

Return Values

Type	Description
`error`	On failure, returns error wrapping `ErrInstallFailed`

Example

// Install all dependencies (including dev dependencies)
err := comp.Install(false, false)
if err != nil {
	log.Fatalf("Failed to install dependencies: %v", err)
}

// Install only production dependencies and optimize autoloader (common for production deployment)
err = comp.Install(true, true)

Advanced

Use InstallWithOptions when more options are needed.
Use InstallDryRun to dry-run without actually installing.

⚙️ `InstallWithOptions`

Install dependencies with custom options, supporting arbitrary combinations of composer long options.

Signature

func (c *Composer) InstallWithOptions(options map[string]string) error

Parameters

Parameter	Type	Description
`options`	`map[string]string`	Install options map; keys are option names, values are option values (empty string for flag)

Example

options := map[string]string{
	"no-dev":            "",
	"optimize-autoloader": "",
	"prefer-dist":       "",
	"no-progress":       "",
}
err := comp.InstallWithOptions(options)
if err != nil {
	log.Fatalf("Failed to install dependencies: %v", err)
}

🔄 `Update`

Update project dependencies to latest versions; can specify package names or update all.

Signature

func (c *Composer) Update(packages []string, noDev bool) error

Parameters

Parameter	Type	Description
`packages`	`[]string`	List of package names to update; empty slice updates all packages
`noDev`	`bool`	`true` adds `--no-dev`

Example

// Update all dependencies (including dev dependencies)
err := comp.Update([]string{}, false)

// Update only specified packages
err = comp.Update([]string{"symfony/console", "symfony/process"}, false)

// Update only production dependencies
err = comp.Update([]string{}, true)

Advanced

To update transitive dependencies as well, use UpdateWithDependencies or UpdateWithAllDependencies.
To only refresh lock hash, use UpdateWithLock.

⚙️ `UpdateWithOptions`

Update dependencies with custom options.

Signature

func (c *Composer) UpdateWithOptions(packages []string, options map[string]string) error

Parameters

Parameter	Type	Description
`packages`	`[]string`	List of package names to update
`options`	`map[string]string`	Update options map

Example

options := map[string]string{
	"no-dev":            "",
	"prefer-dist":       "",
	"with-dependencies": "",
	"no-progress":       "",
}
err := comp.UpdateWithOptions([]string{"symfony/console"}, options)

⚡ `DumpAutoload`

Generate Composer's autoload files, optionally optimized.

Signature

func (c *Composer) DumpAutoload(optimize bool) error

Parameters

Parameter	Type	Description
`optimize`	`bool`	`true` adds `--optimize`, generates class map (recommended for production)

Example

// Generate standard autoload files (development environment)
err := comp.DumpAutoload(false)

// Generate optimized autoload files (production deployment)
err = comp.DumpAutoload(true)

Advanced

Use DumpAutoloadWithOptions when more options are needed (like --classmap-authoritative, --apcu, --no-dev).

⚙️ `DumpAutoloadWithOptions`

Generate autoload files with custom options.

Signature

func (c *Composer) DumpAutoloadWithOptions(options map[string]string) error

Example

options := map[string]string{
	"optimize":             "",
	"classmap-authoritative": "",
	"apcu":                 "",
	"no-dev":               "",
}
err := comp.DumpAutoloadWithOptions(options)

🔒 `UpdateWithLock`

Only update the hash value of the composer.lock file, without actually updating any package versions. Used to fix when composer.lock hash is out of sync with composer.json.

Signature

func (c *Composer) UpdateWithLock() error

Example

err := comp.UpdateWithLock()
if err != nil {
	log.Fatalf("Failed to update lock file: %v", err)
}

🧪 `InstallDryRun` / `UpdateDryRun`

Simulate install/update execution without actually modifying the filesystem, commonly used for CI dry-runs or checking which packages would change.

Signatures

func (c *Composer) InstallDryRun() (string, error)
func (c *Composer) UpdateDryRun(packages []string) (string, error)

Parameters (`UpdateDryRun`)

Parameter	Type	Description
`packages`	`[]string`	List of package names to simulate updating; empty simulates updating all packages

Return Values

Type	Description
`string`	Simulated execution output
`error`	Execution error

Example

output, err := comp.InstallDryRun()
if err != nil {
	log.Fatalf("Dry-run install failed: %v", err)
}
fmt.Println(output)

output, err = comp.UpdateDryRun([]string{"symfony/console"})

🏭 Single-option Shortcut Methods

Each of the following methods appends a single fixed option, with simple signatures and clear semantics:

Method	Equivalent Command	Description
`InstallWithPreferSource() error`	`install --prefer-source`	Force install from source (Git), convenient for debugging/source editing
`InstallWithPreferDist() error`	`install --prefer-dist`	Force install from distribution package (zip), fast, suitable for production
`InstallNoScripts() error`	`install --no-scripts`	Skip script execution, common in CI/CD
`InstallWithClassmapAuthoritative() error`	`install --classmap-authoritative`	Authoritative class map, load only from class map, boosts production performance
`InstallWithAPCu() error`	`install --apcu-autoloader`	Enable APCu cache for autoloading, requires PHP APCu extension
`InstallNoDev() error`	`install --no-dev`	Don't install dev dependencies
`UpdateWithPreferSource(packages []string) error`	`update --prefer-source [packages...]`	Update from source
`UpdateWithPreferDist(packages []string) error`	`update --prefer-dist [packages...]`	Update from distribution package
`UpdateNoScripts(packages []string) error`	`update --no-scripts [packages...]`	Update skipping scripts
`UpdateNoDev(packages []string) error`	`update --no-dev [packages...]`	Don't update dev dependencies
`UpdateWithDependencies(packages []string) error`	`update --with-dependencies [packages...]`	Update with dependencies
`UpdateWithAllDependencies(packages []string) error`	`update --with-all-dependencies [packages...]`	Recursively update all dependencies

Example

// Production deployment: dist package + no scripts + authoritative class map
_ = comp.InstallWithPreferDist()
_ = comp.InstallNoScripts()
_ = comp.InstallWithClassmapAuthoritative()

// Update specified packages with dependencies
_ = comp.UpdateWithDependencies([]string{"symfony/console"})
_ = comp.UpdateWithAllDependencies([]string{"symfony/console"})

APCu Prerequisite

InstallWithAPCu requires the PHP APCu extension to be installed and enabled, otherwise composer will error.

📁 `InstallWithWorkingDir`

Execute install in a specified working directory, restoring the original working directory after completion. Suitable for one-off operations on other projects without affecting the instance's default directory.

Signature

func (c *Composer) InstallWithWorkingDir(workingDir string, noDev bool, optimize bool) error

Parameters

Parameter	Type	Description
`workingDir`	`string`	Working directory path
`noDev`	`bool`	Whether to skip dev dependencies
`optimize`	`bool`	Whether to optimize autoloader

Example

err := comp.InstallWithWorkingDir("/srv/other-app", true, true)
if err != nil {
	log.Fatalf("Install failed: %v", err)
}

Advanced

Implementation temporarily modifies c.workingDir and uses defer to restore the original value; it restores even if a panic occurs during execution.
For a more general "run any command in another directory", use ExecWithWorkingDir (see exec).

🔍 `CheckDependencies`

Check whether composer.json and composer.lock are in sync and whether dependencies have conflicts.

Signature

func (c *Composer) CheckDependencies() (string, error)

Example

output, err := comp.CheckDependencies()
if err != nil {
	log.Fatalf("Dependency check failed: %v", err)
}
fmt.Println("Dependency check result:", output)

💡 `Suggests`

View and install suggested packages (composer suggests).

Signature

func (c *Composer) Suggests() error

Advanced

For options, use SuggestsWithOptions(options map[string]string) (string, error).
To query suggestions for a specific package, use SuggestsForPackage(packageName string) (string, error).

💰 `FundPackages` / 🔒 `RunAudit`

Method	Signature	Equivalent Command
`FundPackages`	`FundPackages() (string, error)`	`composer fund` — list packages accepting donations
`RunAudit`	`RunAudit() (string, error)`	`composer audit` — find known security vulnerabilities

fundOutput, _ := comp.FundPackages()
auditOutput, _ := comp.RunAudit()

Stronger Audit Capabilities

RunAudit returns raw text. For structured vulnerability lists and severity filtering, use GetAuditInfo(), HasVulnerabilities(), GetHighSeverityVulnerabilities() in the Security Audit module.

🧭 Next Steps

🔍 Packages — RequirePackage / Remove / Show / Search / Outdated
🛠️ Core Runtime — Run / RunWithContext / SetWorkingDir
🔒 Security Audit — Structured vulnerability scanning and abandoned package detection

📦 Dependencies ​

🎯 When to Use ​

📋 Method Overview ​

📥 Install ​

Signature ​

Parameters ​

Return Values ​

Example ​

Advanced ​

⚙️ InstallWithOptions ​

Signature ​

Parameters ​

Example ​

🔄 Update ​

Signature ​

Parameters ​

Example ​

Advanced ​

⚙️ UpdateWithOptions ​

Signature ​

Parameters ​

Example ​

⚡ DumpAutoload ​

Signature ​

Parameters ​

Example ​

Advanced ​

⚙️ DumpAutoloadWithOptions ​

Signature ​

Example ​

🔒 UpdateWithLock ​

Signature ​

Example ​

🧪 InstallDryRun / UpdateDryRun ​

Signatures ​

Parameters (UpdateDryRun) ​

Return Values ​

Example ​

🏭 Single-option Shortcut Methods ​

Example ​

📁 InstallWithWorkingDir ​

Signature ​

Parameters ​

Example ​

Advanced ​

🔍 CheckDependencies ​

Signature ​

Example ​

💡 Suggests ​

Signature ​

Advanced ​

💰 FundPackages / 🔒 RunAudit ​

🧭 Next Steps ​

📦 Dependencies

🎯 When to Use

📋 Method Overview

📥 `Install`

Signature

Parameters

Return Values

Example

Advanced

⚙️ `InstallWithOptions`

Signature

Parameters

Example

🔄 `Update`

Signature

Parameters

Example

Advanced

⚙️ `UpdateWithOptions`

Signature

Parameters

Example

⚡ `DumpAutoload`

Signature

Parameters

Example

Advanced

⚙️ `DumpAutoloadWithOptions`

Signature

Example

🔒 `UpdateWithLock`

Signature

Example

🧪 `InstallDryRun` / `UpdateDryRun`

Signatures

Parameters (`UpdateDryRun`)

Return Values

Example

🏭 Single-option Shortcut Methods

Example

📁 `InstallWithWorkingDir`

Signature

Parameters

Example

Advanced

🔍 `CheckDependencies`

Signature

Example

💡 `Suggests`

Signature

Advanced

💰 `FundPackages` / 🔒 `RunAudit`

🧭 Next Steps