What is the difference between require and require-dev sections in composer.json?

Question

I'm starting to use the composer, I know so little about it and am a little versed in developing web applications.

I'm just browsing Nettuts + Tutorial , so I have a basic question about the composer.

{ "require": { "laravel/framework": "4.0.*", "way/generators": "dev-master", "twitter/bootstrap": "dev-master", "conarwelsh/mustache-l4": "dev-master" }, "require-dev": { "phpunit/phpunit": "3.7.*", "mockery/mockery": "0.7.*" }, "autoload": { "classmap": [ "app/commands", "app/controllers", "app/models", "app/database/migrations", "app/database/seeds", "app/tests/TestCase.php" ] }, "scripts": { "post-update-cmd": "php artisan optimize" }, "minimum-stability": "dev" } 

• Whatever appears in the “require-dev” part will only be downloaded and installed with the installation of the --dev composer?
• I read some composer documentation, but still don’t understand, what is the reason that we have the “require-dev” part? Is it because we want to get a specific version of the package, and not always get the latest stable version?

Answer 1

Various environments

As a rule, the software will work in different environments:

• development
• testing
• staging
• production

Different dependencies in different environments

Dependencies declared in the require composer.json section are usually dependencies that are needed to run an application or package in

• staging
• production

whereas the dependencies declared in the require-dev section are usually the dependencies that are required in

• developing
• testing

Wednesday.

For example, in addition to the packages used to actually run the application, software development may require packages such as:

• friendsofphp/php-cs-fixer (for detecting and fixing coding style issues)
• squizlabs/php_codesniffer (for detecting and fixing coding style issues)
• phpunit/phpunit (for managing development with tests)
• and etc.

Deployment

Now, in development and testing environments, you usually run

 $ composer install 

to install production and development dependencies.

However, in staging and production environments, you want to install the dependencies necessary to run the application, and as part of the deployment process, you usually run

 $ composer install --no-dev 

to install only production dependencies.

Semantics

In other words, sections

• require
• require-dev

tell composer which packages should be installed at startup

 $ composer install 

or

 $ composer install --no-dev 

That's all.

Note Depending on the development of the packages that your application or package depends on, they will never be installed.

For reference see:

• https://getcomposer.org/doc/04-schema.md#require
• https://getcomposer.org/doc/04-schema.md#require-dev

Answer 2

• According to the guide for the composer :

  require-dev (root only)

  List of packages needed to develop this package or run tests, etc. The requirements of the root package developer are set by default. Both install or update support the --no-dev option, which prevents the installation of dependencies between developers.

  Thus, running composer install also load development dependencies.

• The reason is actually quite simple. When contributing to a particular library, you can run test suites or other development tools (such as symfony). But if you install this library in a project, these dependencies may not be required: not every project requires a test runner.

Answer 3

From the composer's site (this is clear enough)

required #

Lists the packages required by this package. The package will not be if these requirements are not met.

require-dev (root only) #

Lists packages needed to develop this package or run tests, etc. The requirements of the root package developer are set by default. Both installation or upgrade options support the -no-dev option, which prevents the installation of dependencies between developers.

Using require-dev in Composer, you can declare the dependencies necessary for developing / testing a project, but not requiring production. When you upload the project to your production server (using git), the require-dev will be ignored.

Also check out this answer posted by the author and this post .

Answer 4

section required This section contains packages / dependencies that are the best candidates for installation / required in a production environment.

require-dev section: This section contains packages / dependencies that the developer can use to test the code (or for the experiment purpose on her local machine and she wants these packages should not be installed on the production environment.)

Answer 5

The general rule is that you want packages from the require-dev section only to be in development environments (dev), for example, in a local environment.

Packages in the require-dev section are packages that help you debug your application, run tests, etc.

In an intermediate and production environment, perhaps you only need packages from the require section.

But in any case, you can start the installation of the composer --no-dev and composer update --no-dev in any environment, the command will install only packages from the required section, not from require-dev , but you probably want to run this only when setting up and releasing the medium at a local level.

Theoretically, you can put all packages in the required partition and nothing will happen, but you do not want to create packages in the production environment for the following reasons:

1. speed
2. the ability to post some debugging information
3. etc

Some good candidates for require-dev :

 "filp/whoops": "^2.0", "fzaninotto/faker": "^1.4", "mockery/mockery": "^1.0", "nunomaduro/collision": "^2.0", "phpunit/phpunit": "^7.0" 

You can see what the above packages do, and you will see why you do not need them in production.

See here for more details: https://getcomposer.org/doc/04-schema.md