• Official website: https://getcomposer.org/
• Package repositories:
  • Main: https://packagist.org/
  • Secondary: https://asset-packagist.org (after considering other options)
• Tiki uses Composer to manage 150+ library dependencies in PHP and JavaScript, which are bundled as part of the regular Tiki install.
  • Some Tiki dependencies also have their own dependencies. The whole list is tracked at composer.lock
• Superfluous code is removed via CleanVendors
• Starting in Tiki18, there is a web-based tool to install Packages, which permits to manage even more libraries. This is to provide easy access to dependencies that are not shipped as part of the standard Tiki installation.
• cweagans/composer-patches is used to patch dependencies. This is usually used until a patch is incorporated in a released version of a library
  • The patches should be versioned as binary files, to avoid problems with line breaks
  • Please see https://gitlab.com/tikiwiki/tiki/-/tree/master/installer/composer-patches
• The Tiki community runs its own instance of Satis, a Simple static Composer repository generator. Source: satis.json, web: http://composer.tiki.org
• Picking and maintaining dependencies is a critical skill because https://www.reddit.com/r/programming/comments/1z09jq/why_your_software_project_will_slowly_die_without/
• Here are guidelines for what should be available via Tiki Packages vs built-in to Tiki directly, as we are careful to manage complexity and avoid the worst of dependency hell, as explained at https://pluginproblems.com
• Developers coordinate here: https://dev.tiki.org/Composer

• Tiki started in 2002, and there was no such tool to manage dependencies
• The first release of Composer was in 2012.
• In 2013, Tiki started using Composer and progressively porting dependencies (instead using SVN externals)
• From 2014 to 2017: dependencies are progressively migrated to Composer
• In 2017, Composer usage in Tiki was revamped and a web-based Composer tool was added -> Packages
• In 2018, we added support for asset-packagist.org for when dependencies are not on Packagist.org but only NPM or Bower.
• In 2018, a simple way to install packages via FTP: https://packages.tiki.org/
• In 2021, we moved to Composer v2, in time for Tiki23 so it will be nice and robust for Tiki24LTS
• In 2021, it was announced that Composer 2.2 is LTS
• In 2024, A new build system was added for JavaScript and CSS dependencies (The PHP dependencies will stay with Composer)
  • This permitted a large reduction in number of dependencies managed by Composer
• In 2024, announcement of the complete shutdown of Composer 1.x metadata access on Packagist.org planned for 2025-08-01. This is not a problem for the Tiki community since:
  • Tiki24+ uses Composer 2.x already
  • Tiki21 is supported until 2025-03 so it will be end of life beforehand
  • And for those with Tiki 21x needing longer support, composer.tiki.org keeps a copy of the packages for longer (end of life not determined yet)
• In 2025, Multi-repository support with Packagist.org, Asset-Packagist.org, and composer.tiki.org was added
  • The decision was taken to phase out the usage of composer.tiki.org (And mostly rely on Packagist.org)
    • composer.tiki.org will stay online until the end of life of Tiki24 LTS (March 2027)

      
      

Please visit https://dev.tiki.org/Composer if you are getting an error about Composer or about a package managed with Composer.