Composer JSON Validator

Validate and lint PHP Composer composer.json files for structure, dependencies, autoload configuration, and best practices.

Commands

lint — Run all lint checks

python3 scripts/composer_json_validator.py lint composer.json
python3 scripts/composer_json_validator.py lint composer.json --strict
python3 scripts/composer_json_validator.py lint composer.json --format json
python3 scripts/composer_json_validator.py lint composer.json --format markdown

dependencies — Inspect require/require-dev

python3 scripts/composer_json_validator.py dependencies composer.json
python3 scripts/composer_json_validator.py dependencies composer.json --format json

scripts — Inspect scripts section

python3 scripts/composer_json_validator.py scripts composer.json
python3 scripts/composer_json_validator.py scripts composer.json --format markdown

validate — Full validation (structure + lint + summary)

python3 scripts/composer_json_validator.py validate composer.json
python3 scripts/composer_json_validator.py validate composer.json --strict --format json

Flags

Lint Rules (22 checks)

Structure (5)

1. Valid JSON syntax
2. Required fields: name, description, type
3. Valid package name format (vendor/package)
4. Valid type value (library, project, metapackage, composer-plugin)
5. license field present and valid SPDX identifier

Dependencies (6)

1. No duplicate packages across require and require-dev
2. Version constraints use valid operators (^, ~, >=, etc.)
3. No dev-only packages in require (phpunit, mockery, etc.)
4. No wildcard * versions
5. PHP version constraint present in require
6. ext- dependencies are explicit (not )

Autoload (4)

1. PSR-4 autoload defined
2. Namespace ends with \\ (PSR-4 convention)
3. No duplicate namespaces across autoload entries
4. autoload-dev separate from autoload

Best Practices (7)

1. scripts section present
2. No post-install-cmd/post-update-cmd executing arbitrary URLs
3. config.sort-packages enabled
4. minimum-stability explicit when not stable
5. prefer-stable set when minimum-stability is not stable
6. No hardcoded absolute paths in autoload
7. All repository URLs use HTTPS

Exit Codes

Example Output

composer.json lint results
==========================
[ERROR]   name: Package name must match vendor/package format
[WARN]    dependencies: phpunit/phpunit found in require (should be in require-dev)
[WARN]    autoload: config.sort-packages not enabled
[INFO]    scripts: scripts section present

Summary: 1 error(s), 2 warning(s), 1 info