PHP uses composer to manage dependencies

What problems to solve: 
    1. Manage php third-party dependencies 
    2. Third-party dependencies do not need to be tracked, and the code occupies a small area. 

Basic constraints: 

    tilde ~1.2 is equivalent to >=1.2 <2.0.0 and ~1.2.3 is equivalent to >=1.2 .3 <1.3.0 
    zigzag ^ It allows to upgrade the version to a safe version. For example, ^1.2.3 is equivalent to >=1.2.3 <2.0.0 


composer.lock-lock file 
    Meaning: After installing dependencies, Composer will write the exact version number list during installation into the composer.lock file. This will lock the specific version of the project. This is very important because the install command will check whether the lock file exists, and if it exists, it will download the specified version (ignoring the definition in the composer.json file). 
    Upgrade: To upgrade to a new version, just use the update command, so that you can get the latest version of the package and also update your composer.lock file. 

Installation: 
    composer install 

all updates: composer update. The component will be updated to the latest stable version and the most composer.lock file will be updated. 

Regarding auto-loading 
    require'vendor/autoload.php'; 


Question: How to upgrade a certain package? // To be verified 
    update cannot pass in the new version number on the command line. You need to manually specify the new version number in composer.json, and then execute the update command.
    // Install package composer require hashids/hashids: 2.0.0 
    // Installed and upgraded composer require hashids/hashids: 3.0.0 
    // Installed and downgraded composer require hashids/hashids: 2.0.4 

    Also: the development process is generally not suitable for update Command, because the update command will update all dependencies to the latest, this action is dangerous, the library you used before may have been updated completely out of recognition and your previous code is unavailable. 

Question: Do composer.lock and composer.json need to be tracked? // The answer is yes, but the actual project requirements 
    are specifically emphasized in the document, Commit your application's composer.lock (along with composer.json) into version control.