Taming Dependencies: How to Install a Specific Version of a Composer Package

Composer: The Art of Dependency Management in PHP

Imagine you are an architect building a skyscraper. You cannot manufacture every brick and every beam yourself. You order ready-made, proven materials. In the PHP world, this role is brilliantly played by Composer — a dependency manager that brought order, versioning, and the ability to avoid reinventing the wheel every time to our world.

But what do you do if the latest version of a library "breaks" your code? Or you know for sure that version 2.1.5 worked perfectly, but version 2.2.0 introduced bugs that haven't been fixed yet? In this article, we will not just answer the popular Stack Overflow question: "How to install a specific version of package using Composer?". We will break this process down to the smallest detail, adding a touch of optimization magic and improving your project's performance.

Get your terminal ready, let's begin!

Why Pinning a Version is Not a Whim, But a Necessity?

Many developers, especially beginners, make the same mistake: they write composer require vendor/package without specifying a version. In this case, Composer will kindly pull in the latest stable version. What's wrong with that, you might think? It's simple: today the library works, but tomorrow its author releases a major update with changes that completely break your code. Welcome to debugging hell!

Version pinning is your insurance policy. You clearly state: "Composer, install exactly this version for me, and don't you dare touch it without my knowledge." This directly affects the stability and performance of development, as you spend time writing code rather than dealing with surprises from updates.

How to Install a Specific Version of a Package? Three Legitimate Methods

Let's move on to practice. We have three main scenarios, and each has its own command.

Method 1: "Express Installation" via composer require

The fastest and most popular method. You simply add the desired version to the package name with a colon.

Syntax:

composer require vendor/package:version

Real-world example: Let's say you need Monolog version 2.3.5 (not the latest 3.x, which changed the API).

composer require monolog/monolog:2.3.5

What happens under the hood? Composer:

\n
• Checks for conflicts with already installed packages.
\n
• Adds an entry to composer.json.
\n
• Downloads exactly that version and updates composer.lock.
\n

Important! If you want to install a package that already exists, but a different version, use the --no-update flag for optimization:

composer require monolog/monolog:2.3.5 --no-update\ncomposer update monolog/monolog

This approach reduces the load on Composer and speeds up the process, as it won't recalculate all dependencies but will focus only on the required package.

Method 2: "Manual Management" via composer.json

This method is preferable when you are working in a team or setting up a project from scratch. You open the composer.json file and manually specify the dependencies.

Find the "require" section and add the line:

{\n    "require": {\n        "php": "^8.1",\n        "monolog/monolog": "2.3.5",\n        "guzzlehttp/guzzle": "7.4.*"\n    }\n}

After editing the file, run the command:

composer update

This method gives you full control. Pay attention to version masks:

\n
• 2.3.5 — an exact version.
\n
• 7.4.* — any version within the minor release 7.4 (7.4.0, 7.4.1