Listing Composer dependencies in CSV format

We work with larger public sector organisations who often require lists of third party dependencies we use on projects. I took at look at the different ways you can list all Composer dependencies in a PHP project.

This command lists all PHP dependencies in a project:

composer show 

However, this displays as text. The compliance document I’m currently filling in is in Excel so ideally I need to copy this into Excel to send to the client.

You can also output your list of dependencies as JSON:

composer show --format=json

And then copy this into a tool such as Csvjson to convert to a CSV file.

I had to edit the JSON to convert to a flat CSV file, removing the root “installed” element. I edited the JSON from:

{
     "installed": [
         {
             "name": "brick/math",
             ...
         },
         ...
         {
             "name": "webmozart/assert",
             ...
         }
     ]
 }

To:

[
         {
             "name": "brick/math",
             ...
         },
         ...
         {
             "name": "webmozart/assert",
             ...
         }
]

The JSON to CSV tool then downloads a clean CSV file which I can import into Excel and supply to my client!

Another useful command is:

composer licenses

That outputs the open source license used for each package. This also supports JSON output so can be converted to CSV in the same way.

CSV output seems a useful feature to me, so I suggested this on the Composer discussion board. If others agree, I’ll see if I can contribute this. Otherwise I may look at building a small Composer plugin.