Installing Packages

With composer.json in place, the next step is actually pulling packages into your project. This page covers finding packages, installing them with composer require, targeting a specific version, removing a package you no longer need, and exactly what changes on disk each time.

Finding Packages on Packagist

Packagist.org is the default public package repository that Composer searches. It's a searchable catalog of hundreds of thousands of open source PHP packages — logging libraries, HTTP clients, testing tools, entire frameworks, and more. Each package page shows its available versions, install command, and dependencies, so it's usually the first place to look before installing anything.

Installing a Package with composer require

Once you've found a package, installing it is a single command:

$ composer require monolog/monolog

This one command does two things at once: it adds monolog/monolog (with a suitable version constraint) to the require section of your composer.json, and it immediately downloads the package — along with anything it depends on — into your project's vendor/ folder. You don't need to edit composer.json by hand first.

Installing a Specific Version

If you need a particular version or version range rather than whatever Composer picks by default, append it after a colon:

$ composer require monolog/monolog:^2.0

This tells Composer to constrain the install to the ^2.0 range specifically, which is useful when a newer major version isn't compatible with the rest of your project yet.

Removing a Package

When you no longer need a package, remove it the same way — with a dedicated command rather than just deleting folders by hand:

$ composer remove monolog/monolog

This removes the entry from composer.json and deletes the package (and any dependencies no longer needed by anything else) from vendor/, keeping everything in sync.

What Actually Happens on Disk

After running composer require, three things on disk reflect the change:

That last file, composer.lock, is important enough to get its own dedicated page shortly — for now, just know that it records exact versions so installs stay reproducible across machines.