We work with larger public sector organisations who often require lists of third party dependencies we use on projects. I took at look at the different ways you can list all Composer dependencies in a PHP project.
This command lists all PHP dependencies in a project:
composer show
However, this displays as text. The compliance document I’m currently filling in is in Excel so ideally I need to copy this into Excel to send to the client.
You can also output your list of dependencies as JSON:
composer show --format=json
And then copy this into a tool such as Csvjson to convert to a CSV file.
I had to edit the JSON to convert to a flat CSV file, removing the root “installed” element. I edited the JSON from:
{
"installed": [
{
"name": "brick/math",
...
},
...
{
"name": "webmozart/assert",
...
}
]
}
To:
[
{
"name": "brick/math",
...
},
...
{
"name": "webmozart/assert",
...
}
]
The JSON to CSV tool then downloads a clean CSV file which I can import into Excel and supply to my client!
Another useful command is:
composer licenses
That outputs the open source license used for each package. This also supports JSON output so can be converted to CSV in the same way.
CSV output seems a useful feature to me, so I suggested this on the Composer discussion board. If others agree, I’ll see if I can contribute this. Otherwise I may look at building a small Composer plugin.