Fix common Composer errors on a server

Composer manages PHP dependencies for Laravel, Symfony, Drupal and many other apps. On servers it fails for a predictable set of reasons. This guide explains the most common Composer errors and how to fix each.

Before you start

• SSH access (or the cPanel Terminal).
• Run Composer as the user who owns the project, not root.
• For deployments, prefer composer install --no-dev --optimize-autoloader, which installs exactly what composer.lock specifies.

Allowed memory size exhausted

PHP Fatal error: Allowed memory size of 1610612736 bytes exhausted

Dependency resolution during update or require can use a lot of RAM. Remove the limit for that run:

COMPOSER_MEMORY_LIMIT=-1 composer update

On small servers, run composer update on your computer, commit composer.lock, and only run composer install on the server, which needs far less memory.

Your requirements could not be resolved: php version

Root composer.json requires php ^8.2 but your php version (8.1.27) does not satisfy that requirement.

The CLI PHP is older than required, even if the website uses a newer one. Check with php -v. Fixes:

• VPS: switch the default with update-alternatives --config php, or run php8.3 /usr/local/bin/composer install.
• cPanel: use the versioned binary, e.g. /opt/cpanel/ea-php83/root/usr/bin/php /opt/cpanel/composer/bin/composer install, or /opt/alt/php83/usr/bin/php on CloudLinux.

Missing PHP extension

requires ext-intl * -> it is missing from your system

Install or enable the extension for the CLI PHP version (e.g. apt install php8.3-intl; in cPanel, Select PHP Version). Do not bypass it with --ignore-platform-reqs on production; the app will fail at runtime instead.

Dependency conflicts

Problem 1 - package/a 2.0 requires package/b ^3.0 -> found package/b[2.5] but it does not match the constraint.

• Ask Composer why: composer why-not package/b 3.0 and composer why package/b.
• Update the related packages together: composer update package/a package/b --with-all-dependencies.
• Loosen an overly strict constraint in composer.json if appropriate.

Lock file out of date

Warning: The lock file is not up to date with the latest changes in composer.json.

Someone edited composer.json without updating the lock. Run composer update --lock (or the specific package update) in development and commit the new composer.lock. On servers, always deploy a matching pair.

Authentication and rate limits

• GitHub API limit / private repositories: create a token and run composer config --global github-oauth.github.com YOUR_TOKEN.
• Private registries (e.g. Magento, Nova): store credentials in auth.json (outside Git) or with composer config http-basic.repo.example.com user pass.

Do not run Composer as root

Composer warns because package scripts run with your privileges, and files end up owned by root, causing permission errors for the web server later. Run as the project owner: sudo -u deploy composer install. If you already ran it as root, fix ownership with chown -R deploy:deploy vendor.

Other frequent issues

• The zip extension and unzip/7z commands are both missing: install unzip or the PHP zip extension.
• proc_open(): fork failed: out of memory; add swap or run on a larger machine.
• Script @php artisan package:discover handling returned with error: the app itself fails to boot (missing .env, database). Read the error above it.

Composer FAQ

install or update on the server?

install. It reproduces the tested lock file. update changes versions and belongs in development.

How do I update Composer itself?

composer self-update (or via your package manager if installed that way).

Is Composer available on cPanel?

Yes, on most cPanel servers via SSH or Terminal. See the cPanel Composer guide.

Next steps

• Use Composer on cPanel
• Install PHP extensions
• Deploy Laravel on a VPS