What is Composer and how does autoloading work in PHP?

Composer is PHP's dependency manager. composer.json declares what you need with version constraints; composer.lock records the exact versions actually installed, so every environment gets an identical dependency tree.

Note: Commit composer.lock for an application; do not commit it for a library. And composer install honours the lock file while composer update resolves fresh versions and rewrites it — using update on a deploy is a common and dangerous mistake.

Autoloading means classes load on demand instead of being manually included. When PHP encounters an unknown class, it calls the registered autoloader, which maps the class name to a file path and includes it.

{
  "autoload": {
    "psr-4": { "App\\": "src/" }
  }
}

Under PSR-4, App\Service\Payment resolves to src/Service/Payment.php. Namespace separators become directory separators, and the class name must match the filename exactly — including case, which is why code works on a case-insensitive Mac and breaks on a Linux server.

In production, run composer install --no-dev --optimize-autoloader, which builds a static class map so no filesystem lookup is needed per class.