composer/composer

This system is a PHP-based package manager that manages project dependencies, autoloading, and installation. It provides a command-line interface for resolving and installing packages from various version control and repository sources. The system includes features for security auditing, malware filtering, and plugin extensibility, all supported by a modular architecture for configuration, caching, and HTTP transport.

This period focused on a comprehensive architectural overhaul of Composer's core subsystems, including the dependency resolver, package model, and downloader infrastructure. The changes introduced modular, promise-based execution models to enable parallel package downloads and installations, significantly improving performance and maintainability. Additionally, the codebase was stabilized with extensive test coverage and updated dependencies to support modern PHP versions.

30 changes

This period focused on refactoring Composer's internal subsystems, including the IO layer, authentication helpers, and plugin API, to improve modularity and testability. The work established a robust foundation by introducing new class hierarchies, event-driven mechanisms, and comprehensive unit and functional tests across the codebase.

22 changes

This period focused on modernizing Composer's internal architecture by introducing new interfaces for plugin capabilities, HTTP handling, and audit systems. The work also involved significant improvements to static analysis configuration, platform detection utilities, and comprehensive test coverage for these new components.

25 changes

This period focused on introducing a unified dependency policy framework and a new filter list system for auditing and blocking packages. The work established the core classes for managing advisories, malware, and abandoned packages, alongside the infrastructure to fetch and apply remote filter lists. Comprehensive test coverage was added to validate the new policy configurations and filter list providers.

9 changes

composer/composer was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point the surveyor at a repository you know and see whether you agree with it.