Title: Using Composer on VIP
Author: WordPress VIP Documentation
Published: August 9, 2021
Last modified: July 2, 2025

---

 1. [Code deployment](https://docs.wpvip.com/code-deployment/)
 2. [GitHub repository](https://docs.wpvip.com/code-deployment/github-repository/)
 3. Using Composer on VIP

#  Using Composer on VIP

[Composer is a package manager for PHP](https://getcomposer.org/) that can be used
when developing for an application on the WordPress VIP Platform.

Composer can be used to pull in runtime dependency packages during a local or continuous
integration (CI) build, and development dependencies tools and configurations for
local development and CI jobs.

## Referencing the root `/vendor` directory

By default, Composer installs dependencies to the `/vendor` directory from where
it is called. For a [`composer.json`](https://getcomposer.org/doc/04-schema.md#the-composer-json-schema)
in the root of the repository, it would be the `/vendor` at the root of the repository.

However, this directory is not one of the [recognized directories](https://docs.wpvip.com/vip-codebase/)
available in the application on VIP. Because of this, references to the `/vendor`
directory and to any files within it will fail.

To make a dependency available to multiple plugins, [set the ](https://getcomposer.org/doc/06-config.md#vendor-dir)`
[vendor-dir](https://getcomposer.org/doc/06-config.md#vendor-dir)` to `/private`,`/
client-mu-plugins/vendor` or a similar directory, in the root `composer.json`.

composer.json

    ```lang-json
    {
        "config": {
            "vendor-dir": "private/vendor"
        }
    	"require": {
    		"example/package": "^1"
    	}
    }
    ```

## Configuring `.deployignore`

A  [`.deployignore` file](https://docs.wpvip.com/development-workflow/automated-build-and-deploy/#h-deploying-built-files-from-gitignore)
can be created and added to a repository. During the build process, the `.deployignore`_
_file is renamed [`.gitignore`](https://git-scm.com/docs/gitignore) just before 
the built files are pushed to `*-built` branches. Files and directories referenced
in `.gitignore` will **not** be pushed to `*-built` branches, including files generated
by a build process.

[Pattern-matching rules](https://git-scm.com/docs/gitignore) for including or excluding
files and directories in `.gitignore`:

> If there is a separator at the beginning or middle (or both) of the pattern, then
> the pattern is relative to the directory level of the particular _.gitignore_ 
> file itself. **Otherwise the pattern may also match at any level below the `.gitignore`
> level.**

 *  `/vendor` will only match the **root** vendor directory (which should only contain
   the PHPCS and other dev-dependencies) since this is the root `.gitignore`
 *  `vendor/` will match **all** vendor directories at all levels.
 * For applications with a runtime dependency, `vendor/`—or other directories named`
   vendor` —should not be included in the [`.deployignore` file](https://docs.wpvip.com/development-workflow/automated-build-and-deploy/#h-deploying-built-files-from-gitignore).

To prevent other non-root directories named `vendor` from being ignored, add the
directory paths for those vendor directories to the `.gitignore` file with a `!`
appended to the directory path.

In the example below, the first line indicates that **all** directories named `vendor`
will be ignored. The second line adds an exclusion for the `/vendor` directory specific
to the plugin “my-custom-plugin”. As a result, all directories named `vendor` will
be ignored _except_ for the `plugins/my-custom-plugin/vendor/` directory.

.gitignore

    ```lang-shell
    vendor/
    !plugins/my-custom-plugin/vendor/
    ```

## Runtime dependencies

### Dependencies needed by one custom plugin

Create a [`composer.json`](https://getcomposer.org/doc/04-schema.md#the-composer-json-schema)
file in that plugin’s directory (e.g. `plugin/my-custom-plugin/composer.json`) with
the required dependency, and run `composer install --no-dev` from that plugin directory.
This will put the dependency into, for example, `plugins/my-custom-plugin/vendor/`.
The call to `require __DIR__ . '/vendor/autoloader.php';` can be in that plugin’s
root file.

### Dependencies needed by multiple plugins or themes

[Set the `vendor-dir`](https://getcomposer.org/doc/06-config.md#vendor-dir) to `/
private`, `/client-mu-plugins/vendor` or a similar directory, in the root composer.
json (as /vendor is not available at runtime), and install dependencies there. To
make use of autoloading, check for the existence of the `vendor/autoloader.php` 
file and require it if it exists. Logic for this check should be added to the `/
client-mu-plugins/plugin-loader.php` file.

### When to install a Composer runtime dependency

There are two points in a workflow when a runtime dependency can be installed.

 * **Recommended Option 1:** Make use of the [continuous integration and deployment (CI/CD)](https://docs.wpvip.com/development-workflow/automated-build-and-deploy/)
   process that VIP supports, so that the dependency is excluded from the local 
   commit, but is pulled down during a build job, just before any tests and the 
   deployment (push to a `*-built` deployment branch).
 * **Option 2:** Use Composer on the local machine to install the runtime dependency.
   Include this built code in a commit and push it to the repository on GitHub. 
   That method has the drawback of potentially making the pull request (and repository)
   very large, and makes code review more difficult.

## Development dependencies

Development dependencies are not needed when building for an application on a VIP
environment. Use `composer install --no-dev` as the command to only install the 
runtime dependencies.

## Use Composer for a development tool and configurations

Members of a team can use the same versions of code standards, testing and other
development tools configurations, by setting them into the root [`composer.json`](https://getcomposer.org/doc/04-schema.md#the-composer-json-schema).

The typical install location of `/vendor` should be added to `.gitignore`. Because
the directory is not available for VIP environments, none of the files will be accessible
during runtime. The increased size of the repo will also cause it to take longer
to clone.

Last updated: July 02, 2025