VulCode

Composer: our changes to an open source project

The dependency manager for PHP: it installs and updates a project's libraries from its composer.json.

All contributions
Language
PHP
GitHub stars
29,549
Project site
getcomposer.org
1merged change
Merged on 8 October 2026.
Number 2 of the 64 GitHub projects with our changes, by stars. First is Zed (91,587).

The change merged into Composer

The docs and the help of the config command say which keys support --json and --merge: besides extra.*, also the policy.* and audit.ignore keys, and the flags are ignored for the other keys.

What it taught us

Docs that describe less than the code does mislead as much as a bug. A list of the supported keys in the command help saves guesswork.

PHP

Our projects in this technology, their screens and when we choose it.

Other projects with our changes: PHP

20 projects in this technology have our merged changes. The bar is the repository's stars, next to it the number of our changes. Each row leads to the project's page.

Composer among all our changes

Day by day from 5 September 2026 to 11 October 2026. A column is every change merged that day, the accent is the changes in Composer.

  • Changes in Composer
  • Changes in other projects

1 merged change in Composer

Merged on 8 October 2026.

On the same day

Changes of ours were also merged into: urfave/cli, Predis, Versity Gateway.

The whole period

125 merged changes in 65 projects.

Questions about our changes to Composer

Where these changes come from, who merged them and whether we can fix something in your library.

Using Composer in your project?

If something in it does not work, we fix it at the source and leave a workaround until the release. We reply within an hour.