Other languages:
English • ‎Türkçe • ‎español • ‎français • ‎magyar • ‎português • ‎русский • ‎中文 • ‎日本語

Composer is a dependency manager for PHP libraries. Starting with MediaWiki 1.25 , MediaWiki core's external library dependencies are being managed with Composer. In addition, it can be used to manage the installation of MediaWiki extensions (available since MediaWiki 1.22 ), however this is currently not well supported. This may change in the future.

Installing ComposerEdit

On Unix/Linux and macOSEdit

There are multiple ways to install Composer, besides the most obvious way, sudo apt install composer.

Currently, only Composer 1.x is supported by MediaWiki. To grab the latest 1.x stable release:

wget -cO - > composer.phar

For users on OS X, you can use Homebrew to install Composer. Note this will install version Composer 2.x, so you may want to follow the wget instructions above instead. To install using brew:

brew install composer

If that doesn't work, or you do not have Homebrew installed, you can try:

php -r "readfile('');" | php

Toolforge and the extension distributor use the copy of Composer contained in the "integration/composer" git repo.

Once Composer is installed, you can run commands via the downloaded phar:

php composer.phar someCommand

You may want to move the phar into your path so it can be used as a normal executable:

mv composer.phar /usr/local/bin/composer
composer someCommand

If the mv command fails due to permissions, execute it again with sudo.

sudo mv composer.phar /usr/local/bin/composer
composer someCommand

On WindowsEdit

Just download and run the installer from the download page. If you prefer manual installation, you can follow the above steps except that Windows doesn’t have wget (or APT or Homebrew) by default, and there is no /usr/local/bin directory. In these cases, you can just download composer-1.phar in your web browser and then rename it to composer.phar.

Upgrading ComposerEdit

If you want to upgrade Composer to the latest 1.x stable (or downgrade from 2.x stable), you can use:

composer self-update --1

If the update command fails due to permissions, execute it again with sudo.

sudo composer self-update --1

If you are on a really old version of composer, it may not have the --1 parameter. In this case, you might want to run self-update twice. The first may update it to 2.x, so the second will downgrade it to the latest version of 1.x.

composer self-update
composer self-update --1

Usage in MediaWiki coreEdit

MediaWiki 1.25+ depends on some external libraries which are managed with Composer. Composer creates an autoloader at vendor/autoload.php, which is included by WebStart.php.

Composer managed dependencies are bundled into tarball distributions of MediaWiki and extensions so system administrators do not need to use Composer directly. When installing MediaWiki using Git, dependencies declared in $IP/composer.json can either be installed locally by running composer update --no-dev or the mediawiki/vendor.git repository can be cloned to provide the same libraries used on the Wikimedia production cluster.[1]

$IP stands for the Installation Path (or "directory") of your MediaWiki installation, the same directory that holds LocalSettings.php , index.php etc..

Using composer-merge-pluginEdit

$IP stands for the Installation Path (or "directory") of your MediaWiki installation, the same directory that holds LocalSettings.php , index.php etc..

MediaWiki core "owns" $IP/composer.json and will change the contents of that file in both tarball and Git managed updates. In order to allow local installs to use Composer to load optional libraries and/or manage extensions with Composer, a special plugin for Composer named composer-merge-plugin was developed.[2] This plugin and the MediaWiki core composer.json configuration allow a local deployment to add required extensions and libraries to a file composer.local.json inside the root MediaWiki directory.

composer.local.json can also be used to install Composer managed libraries that are needed by extensions that are not installed using Composer themselves. This is only needed when the extensions are not installed from tarballs generated by Extension Distributor.

To enable Composer to discover and process the composer.json files that may be included in any and all of your locally installed extensions, add something like this to $IP/composer.local.json:

    "extra": {
        "merge-plugin": {
            "include": [

After any changes to composer.local.json, you need to remove composer.lock before running composer install again so that Composer will recalculate the dependencies and the changes will take effect.