Why is PHP Composer so slow?

Question

Why is PHP Composer so slow when all I do is init a project with zero dependencies? Here are the commands I run:

composer init

<step through composer.json creation, define 0 zero dependencies>

composer install

Wait 3 minutes (not an exaggeration).

All composer has to do is pull in an autoloader and create /vendor, so why does it take so long? For that matter, why doesn't that step happen on composer init?

Is there a configuration option I can use to pull in a cached autloader and vendor upon init?

Solution 1

Also, disable Xdebug. Xdebug can cause Composer to take minutes even when running a command as simple as composer --version.

Solution 2

Because Composer is implemented by file_get_contents(). That has no TCP optimizations, no Keep-Alive, no multiplexing, etc.

I created a Composer plugin to download packages in parallel: https://packagist.org/packages/hirak/prestissimo

$ composer global require hirak/prestissimo

Please try it. In my environment, composer install becomes 10 times faster.

Solution 3

1. Make sure you have the latest version of Composer.
2. Install in verbose mode by adding -vvv, for example composer global require "squizlabs/php_codesniffer=*" -vvv
3. If you are able to find out where Composer is facing slowness, for example mine was getting stuck for 5 minutes when downloading packages. It took >5 minutes to download a 20 kB file on a 50 Mbit/s connection. This was because it was downloading the packages from packagist using HTTP and not HTTPS. Making these changes to the configuration has resolved my issue: composer config --global repo.packagist composer https://packagist.org

Solution 4

The same here. Get more details with "composer install --profile -vvv". In my case it takes a long time to download a few JSON files. They get cached on my server, but they are still downloaded with every Composer update/install call.

... 30 minutes later ...

It looks like some performance problem @packagist.org. Now the Composer install runs within 2 seconds! And downloaded JSON files are properly cached.

Solution 5

I was running into this issue, and it was throwing me for a curve since I don't have Xdebug installed anywhere on my machine. It turns out that it was IPv6 addressing mode failures. So to test I ran

curl --ipv4 'https://packagist.org/packages.json'
curl --ipv6 'https://packagist.org/packages.json'

IPv4 went through, but IPv6 failed. In the end, you should look to find out why you're networking stack doesn't support it, but in my case, I decided to just give preference to IPv4 traffic until I can resolve that. On CentOS I created/modified the file /etc/gai.conf and put in the following:

label       ::1/128        0
label       ::/0           1
label       2002::/16      2
label       ::/96          3
label       ::ffff:0:0/96  4
precedence  ::1/128        50
precedence  ::/0           40
precedence  2002::/16      30
precedence  ::/96          20
precedence  ::ffff:0:0/96  100

On Ubuntu you can also edit that file and uncomment the line

precedence ::ffff:0:0/96  100

Source on Rackspace Community Hub

View more solutions

Comments

[Mark Baker]

More seriously: have you updated your composer in the last 30 days? There was a major performance improvement to the code just last month

[axiac]

I started compose install more than 5 minutes ago and it didn't complete yet. Composer version 1.0-dev (07c644ac229a21df80180598d8bb9aaba232eecb) 2015-02-03 12:51:10. Maybe it's not the most recent version but still newer than your IBM mainframe ;-)

[sjagr]

Please confirm you've done composer self-update

[AgmLauncher]

I have, updated it last week or so.

[Gordon Hickley]

I struggled with composer update and composer self-update being incredibly slow. Taking more than 15 minutes and then throwing exceptions. I changed my router DNS servers (from Google's to my ISP's own) and composer worked like a charm.

[levans]

I was using my ISPs DNS servers, but based on the above comment, I put packagist.org in my /etc/hosts file and things started working. Note you shouldn't consider this canonical as packagist.org's IP is subject to change at any moment. However, it got me through an initial installation.

[Constantin Galbenu]

now, on my machine even composer --version is slow (otherwise a fast machine - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz, 16GB DDR3, SSD)

[AgmLauncher]

This actually turned out to be my issue. Xdebug makes composer run ultra slow.

[Huy Trịnh]

I'm new to composer and try to fix this for 2 days, after read your comment and add -vvv, it's finally worked. 1000 upvotes

[lud]

"They get cached on my server but are still downloaded with every composer update/install call" THIS !! Have you found a solution for this problem ? I have a slow connection and it's terrible to see that.

[cornips]

Wow I went from 124 seconds to install a new laravel project to just 21 seconds. Love it!

[Big Tree]

since i installed prestissimo, my composer speed has been excellent.

[Chuck Le Butt]

Good news: This was apparently merged into Composer 2 in January 2019: github.com/composer/composer/pull/7904

[mwangaben]

I can confirm that this solution works even for ubuntu 18.04LTS

[Andreas Schantl]

#3 solved it for me. You are my hero right now. Was worried for quite some time now why it is so slow and only worked on some internet connections. Thx!

[hejdav]

@ChuckLeButt but release still out of sight :(

[Rishi Kulshreshtha]

composer config --global repo.packagist composer https://packagist.org what was that! Awesome! 🏆

[Ritesh Chitrakar]

Please try using hirak/prestissimo. Its a composer plugin that helps you download packages in quick tempo. link

[Ilyas karim]

Thank you bro. It is 20x faster.

[FantomX1]

In the time of writing, I had the same performance with or without debug, since in 2020/2019 composer automatically disabled xdebug when running, in spite of that installing yii2-starter-kit took about 200 seconds with all libraries be it w/wo xdebug, so this reply is becoming outdated

[FantomX1]

Just for a note, this did not seem to help me personally, although I will have to resimulate it to confirm all the options, which of them could be the cause.

[Aaron Chamberlain]

@FentomX1 Sorry to hear that. That's why I included the test up top. If you do both curl tests and it's connecting, then obviously, the changes shouldn't be made because your network is set up correctly.

[ppostma1]

Saw this, pulled up my debugger. Found that even though xdebug is configured for FPM only, the CLI had initiated it and my IDE was sitting there at a break point waiting for me. Hit continue and composer kicked right back in.

[Mohamed Elbahja]

sudo ? root ? why ?

[sh6210]

sorry brother, add sudo if you've permission issues.

[Mohamed Elbahja]

or should you fix file mode and owner/group permissions? rather than just running SUDO! without knowing what that means? definitely not a FIX.

[sh6210]

of course, you can fix the owner/group permission issue by running the "chown" command, but you can do this in one go. My main intension was to show the solution in the simplest way from my point of view. However, I'm sorry if my words don't make any sense to you.

[dbf]

@sh6210 Do not encourage to use sudo when using composer. Assuming there 'might' a permission problem is prejudice.

[Nico Haase]

How is this related to the given question? Accoirding to the problem description, there is not a single dependency listed in the OPs problem

[Nico Haase]

Please share an explanation for that. The OP is running the tests using a completely empty list of dependencies

[Nico Haase]

Please add some explanation to your answer such that others can learn from it. What does that first line do?

[FantomX1]

The problem should be addressed generically, I tried to summarize all that helped me, and added some other solutions from elsewhere.Not always only for what the asker asks for, here come thousands of other users scenarios.Majority of responses are generic. Composer require is basically just a subpart of composer install. Just because I used also a word/command 'require' in the response, does not mean it does not apply also to install,but if you wish I can remove that word.'There is not a single dependency listed', but how it changes anything, composer install is about nothing but dependencies.

[FantomX1]

I went from 1 point to -1 just a few mins after because I replied to you, maybe because you voted me up previously. Tell me that the chosen answer prestistimo or using ipv 6 or disabling xdebug is not generic too and do not apply to a concrete composer require command. I apologize for a few haste edits but I use it also as a personal wiki, and I did not even list a concrete depedency name, but will adjust it. If you dont like I did a typo, mention that, but not being generic doesnt make sense. I used a 'require' command as a reference, as using 'require' is one of the solutions itself.

[Nico Haase]

The OP asked why Composer is slow with zero dependencies - even if your list of stuff might help in many other situations, I see no connection to the given question

[FantomX1]

You are correct regards that but I either overlooked that or wondered if the user did not use it just for the mere exaggeration of the topic to distance from anybody thinking a particular dependency could be the cause. Somehow when solving it I stumble upon this question from google all the time, maybe also because it is the most popular/most answers regards this topic. And also because the headlines is very generic Why is php composer so slow.

[FantomX1]

You know like sometimes is important also how the community forms the question, the guy can be a one-question guy. You say we should focus on the details what the OP asks,though many moderators explicitly require to be generic. But you say he wanted an empty dependency list,I wonder how the chosen answer with 400 votes using prestissimo paralel downloading benefits an empty dependency list. Or the question with 100 votes. Same with other answers ips,timeouts.It might be not the most proper way, but that's how huge stackoverflow behaves with popular questions.I read between lines of prestisimo.

[Nico Haase]

Well, the OP has selected an answer (XDebug should not be enabled) and wrote that the problem was solved after having disabled XDebug

[FantomX1]

You are right, however that reply is becoming outdated, my comment about that got thrice upvoted. Plus ten time more 365 - people/developers voted for the prestissimo reply, which is unrelated to en empty list. Just saying, the community subconsciously or not want this question to evolve into/answer a different(generic) question, of the composer being slow generally then imo. He asked for an empty list, but in practice solving an issue of an empty list on daily basis is just ludicrous if not used mainly for description. So this question should not have become that popular but other.

[rob006]

Prestissimo helps even with empty require list - some files are downloaded by composer regardless of dependencies list, so parallel download will help here too.

[FantomX1]

If it's the case - seems reasonable, then beg my pardon, though I am still not sure the reply is voted for an empty list, and you can delete these my comments if you want. Thanks

[Aaron Chamberlain]

@NicoHaase If you look at the timestamps, this answer is actually a response to the issue I described, but they didn't put it as a comment. I incorporated it into my answer anyways. It seems that packagist prefers to use IPV6, but some networks still don't work well with it. The first line makes it so that your Linux Machine will prefer IPv4 addresses and look for those first.

[Marcus]

Found a short YouTube video showing how to do this on Windows 10. It fixed my problem. youtube.com/watch?v=63Lt_vlNWLc

[majid mohammadian]

This answer helped me, I had this problem for almost three days, you just have to increase the composer timeout, that's it