Top 23 Composer Open-Source Projects

1. Composer

   1 246 29,539 9.5 PHP

   Dependency Manager for PHP

   

   Project mention: Integrating Web Application Firewalls (WAF) with PHP Framework | dev.to | 2026-09-28

   Composer - refer here for installation guide.

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. bedrock

   2 40 6,575 7.4 PHP

   WordPress boilerplate with Composer and Git, easier configuration, and an improved folder structure

   

4. Medoo

   3 4 4,954 7.6 PHP

   The lightweight PHP database framework to accelerate the development.

   

5. flex

   4 5 4,210 6.1 PHP

   Composer plugin for Symfony (by symfony)

   

6. Laravel-Zero

   5 10 4,009 7.0 PHP

   A PHP framework for console artisans

   

7. Satis

   6 9 3,305 9.0 PHP

   Simple static Composer repository generator - For a full private Composer repo use Private Packagist

   

   Project mention: Building a Composer Proxy Cache with OpenResty | dev.to | 2025-12-22

   Satis is the official static package repository generator for Composer, creating Packagist-compatible JSON format for private packages.

8. setup-php

   7 31 3,264 8.9 TypeScript

   GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.

   

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. SecurityAdvisories

    8 7 2,921 9.5

    :closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily

    

    Project mention: An Update on Composer and Packagist Supply Chain Security | news.ycombinator.com | 2026-05-27

    I arrived at a similar model for NPM using hooks in pnpm: https://github.com/captn3m0/npm-sec-feed. I love the work Packagist/Composer is doing in the space.

    I’m now a firm believer that every package manager needs to support hooks globally.

    Composer also supports conflicts which results in this amazing approach of having a meta-package conflict with insecure packages: https://github.com/Roave/SecurityAdvisories.

    Can’t happen in Node, sadly because of language differences.

11. postprocessing

    9 13 2,874 8.4 JavaScript

    A post processing library for three.js. (by pmndrs)

    

    Project mention: Ball Pit | news.ycombinator.com | 2026-03-25

    TRAA basically works by using a history buffer, for example using the last couple of frames, all jittered a little bit to compute the pixel. There's still ghosting and smearing that can happen though because of this technique, so you have methods to counteract like subpixel correction where u increase temporal alpha when velocity is subpixel, but that can introduce some artifacts as well.

    There's also SMAA T2x which the pmndrs team is planning on integrating into their postprocessing package[0]. This cryengine3 slideshow gives a nice overview of antialiasing methods if you're interested: http://iryoku.com/aacourse/downloads/13-Anti-Aliasing-Method...

    [0] https://github.com/pmndrs/postprocessing

    This paper also provides a decent overview of TRAA:

12. laravel-messenger

    10 3 2,576 1.7 PHP

    Simple user messaging package for Laravel

    

13. PHPCompatibility

    11 21 2,303 8.6 PHP

    PHP Compatibility check for PHP_CodeSniffer

    

    Project mention: How to Know What Breaks Before You Upgrade WordPress to PHP 8.4 | dev.to | 2026-06-30

    Pressready checks both in a single pass: it runs PHPCompatibility for the PHP axis and a custom PHP_CodeSniffer sniff — driven by a generated dataset of WordPress core deprecations — for the WordPress axis.

14. wordplate

    12 7 2,171 8.3 PHP

    A boilerplate for WordPress, built with Composer and designed with sensible defaults.

    

15. SensioLabs Security Check

    13 5 2,143 8.6 PHP

    A database of PHP security advisories

    

    Project mention: A Vulnerability in Libsodium | news.ycombinator.com | 2025-12-30

    This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756

    I'm planning to spend my evening checking every other Ed25519 implementation I can find to see if this check is missing any where else in the open source ecosystem.

16. laravel-hashids

    14 4 2,055 4.7 PHP

    A Hashids bridge for Laravel

    

17. Hprose-PHP

    15 0 1,996 3.0 PHP

    Hprose is a cross-language RPC. This project is Hprose 3.0 for PHP

    

18. laravel-stats

    16 2 1,745 5.9 PHP

    📈 Get insights about your Laravel or Lumen Project

    

19. composer-patches

    17 11 1,733 7.2 PHP

    Simple patches plugin for Composer

    

20. composer-unused

    18 3 1,692 5.5 PHP

    Show unused composer dependencies by scanning your code

    

21. drupal-project

    19 4 1,562 6.7 PHP

    :rocket: Composer template for Drupal projects. Quick installation via "composer create-project drupal-composer/drupal-project"

    

22. docker-php-nginx

    20 6 1,510 5.7 Dockerfile

    Docker image with PHP-FPM 8.5 & Nginx 1.30 on Alpine Linux

    

23. pusher-http-php

    21 2 1,477 5.6 PHP

    PHP library for interacting with the Pusher Channels HTTP API

    

24. Restler

    22 0 1,385 6.2 PHP

    Zero-boilerplate REST API framework for PHP 8+. Auto-generates routes, docs, validation.

    

25. phpqa

    23 5 1,321 8.4 Dockerfile

    Docker image that provides static analysis tools for PHP

    

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

Composer related posts

• Integrating Web Application Firewalls (WAF) with PHP Framework

  2 projects | dev.to | 28 Sep 2026

• Legacy PHP Modernisation: A 2026 Guide

  1 project | dev.to | 1 Sep 2026

• teeny alternatives - inphinit, teeny.js, and teeny.go

  4 projects | 1 Sep 2026

• REST and MCP Servers from the same codebase

  1 project | news.ycombinator.com | 7 Aug 2026

• Composer 2.10 Release features automatic malware blocking

  1 project | news.ycombinator.com | 28 May 2026

• An Update on Composer and Packagist Supply Chain Security

  2 projects | news.ycombinator.com | 27 May 2026

• Cursor Introduces Composer 2.5

  2 projects | news.ycombinator.com | 19 May 2026
• A note from our sponsor - AppSignal
  www.appsignal.com | 5 Oct 2026

  Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com