Can you specify a specific version of Composer in the schema?

Question

Context: I'm working with a team on PHP projects and we just ran into an issue where a code review from another team member modified the format of the all time fields in the composer.lock file. It turned out he was using a much older version of composer which output the time fields in a different format. Once he updated an re-installed the package, the fields remained the same.

Is there a way to specify a minimum version of Composer to require all team members working on a project to use the minimum version to avoid problems like this. If we hadn't spotted this issue, the composer.lock file would have had this unnecessary change happen any time new packages were installed by people with different composer versions

Answer 1

You can create script which will be called before each update, and throw exception if composer version is too old.

In composer.json:

"scripts": {
    "pre-update-cmd": [
        "ComposerVersionCheck::check"
    ]
}

Simple class for version checking:

class ComposerVersionCheck {

    public static function check() {
        if (version_compare(\Composer\Composer::VERSION, '1.7.0', '<')) {
            throw new \Exception(
                'Your Composer version (' . \Composer\Composer::VERSION . ') is too old,'
                . ' 1.7.0 or higher is required.'
            );
        }
    }
}

Answer 2

There are two possibilities:

• either check in composer.phar to ensure everyone is using the same version of composer
• keep composer itself updated at all times to ensure everyone is using the latest version of composer, by running composer self-update

Regardless, since composer changes over time, you would probably still have run into the same issue.

Answer 3

You can do this in composer.json:

"require": {
    "composer": "^2.2",
    [...]
}

Note: this will prevent composer update if <2.2, but not composer install, so it will not ensure that Composer is up to date in the deployment servers and team machines, but it will prevent composer.lock from being changed by older versions.