What's the Difference Between Composer. Lock and Installed. Json?
I Understand That Composer. Lock Is Meant to Pin Down the Exact Version of the Installed Dependencies. but What Purpose Does the Vendor/Composer/Installed...
I understand that composer.lock is meant to pin down the exact version of the installed dependencies. But what purpose does the vendor/composer/installed.json file play?
Both contain JSON and both are generated automatically.
2 Answers
composer.lock is generated when installing for the first time or updating. It contains references to the exact versions used. It should be committed into the version tracking repository to allow restoring this exact combination of libraries.
installed.json is an internal file of Composer. It's used when you remove a package manually from composer.json to remove the files from the vendor directory. Otherwise, the old vendor package would be around forever.
installed.json appears to be used by Composer as an internal repository to keep track of what has actually been installed in the vendor directory.
I've read that composer.lock is what should be installed and installed.json is what is installed. This make some sense in the context that that its valid to have a composer.lock file without a vendor directory. You run composer install and it will install the packages listed int composer.lock and write them to installed.json.
Composers codebase treats installed.json as a local repository. The contents are loaded into a variable of type InstalledRepositoryInterface which is named localRepository.
Robert Thorne covers electric vehicle innovations, autonomous driving systems, global mobility trends, and automotive engineering developments.
