Nested dependencies and private repositories with composer

Question

At the company I'm currently working we've recently started to move our code into different private repositories so that it's more maintainable and reusable (and also to make it easier to open-source it later).

Every PHP repository is also a Composer package that can be required in our project whenever we need it.

At the moment there's an issue with this approach: every time we need a package that depends on other packages we need to specify those also in the root composer.json.

For example, let's say that the in the root composer.json we need to require two packages company\b and company\c, and that the package company\c needs another package company\d. Then the resulting root composer.json will look like this:

{
    "require": {
        "company/b": "dev-master",
        "company/c": "dev-master",
        "company/d": "dev-master"
    },
    "autoload": {
        "psr-4": {
            "Company\\" : "src\Company"
        }
    },
    "repositories": [
        {
            "type": "vcs",
            "url":  "[email protected]:company/b.git"
        },
        {
            "type": "vcs",
            "url": "[email protected]:company/c.git"
        },
        {
            "type": "vcs",
            "url": "[email protected]:company/d.git"
        }
    ]
}

Is there a way to avoid specifying nested dependencies in the root composer.json and use the ones specified in the composer.json in every package?

Edit: Everything I stated before is valid only for the private packages. If a package, let's say company\b, needs a public package that can be found on Packagist then that dependency CAN be specified in the company\b composer.json and it will be imported.

Answer 1

As you correctly found out, only the root package can add repository metadata to the collection of known packages.

I would suggest you take a look at Satis to create a local Composer repository. This would only require you to add this single repository to all your composer.json files of all packages, and it will be used as an updatable source of knowledge about all your private repositories. You no longer have to add a list of Git repos everywhere.

I am successfully hosting around 120 internal packages for our IT enterprise that way. Take this as a sign that once you start splitting isolated tasks into a package, you will get more of them pretty fast.

Also note that it is important to take versioning seriously. Stop depending on branches - tag your software, make releases, use semantic versioning. If you don't, things will break at some point, and people will curse you (correct) or Composer (incorrect) for not working or messing things up.

Answer 2

After a quick search and a look at the Composer documentation I discovered that the repositories can only be specified in the root composer.json.

Additionally it's possible to specify in the root composer.json whether to allow or not development versions of the packages using:

"minimum-stability": "dev",
"prefer-stable": true

Also this issue on GitHub was really useful.