/commands /composer/composer-require-specific-version

composer require vendor/package:version: install a specific package version

Q: How do I add a development-only package?

Add --dev: composer require --dev phpunit/phpunit:^11. It goes to require-dev, which composer install --no-dev leaves out in production.

Q: What constraint does composer require write when I give no version?

Composer picks the newest version compatible with your project and writes a caret constraint for it, such as ^7.9 for version 7.9.2. Pass an explicit constraint to choose a different range.

Q: How do I install a dev branch or a release candidate?

Use the branch or stability in the constraint, for example vendor/pkg:dev-main or vendor/pkg:^3.0@RC. The project's minimum-stability setting decides which unstable versions are allowed without such flags.

updated 2026-10-23

tool: Composer
versions: Composer 2.x
os: any

composer require monolog/monolog:3.7.0 adds the package to the require section of composer.json with that exact version, installs it into vendor/ and records it in composer.lock. The part after the colon is a version constraint: ^3.7 (compatible 3.x from 3.7), ~3.7.0 (3.7.x), 3.7.0 (exact) or a range. Without a constraint, Composer chooses the newest version that fits the project and writes a caret constraint for it.

Usage

bash

composer require monolog/monolog:3.7.0          # exact version
composer require monolog/monolog:^3.7           # 3.7 or newer, below 4.0
composer require "monolog/monolog:>=3.5 <3.8"   # range (quote it)
composer require guzzlehttp/guzzle              # newest compatible version, saved as ^x.y
composer require --dev phpunit/phpunit:^11      # require-dev
composer require monolog/monolog:3.7.0 -W       # allow its dependencies to change too

The constraint can also follow the name after a space (composer require monolog/monolog "^3.7"). Quote constraints that contain spaces, >, <, | or *, because the shell interprets those characters.

Constraint syntax

Constraint	Allows
3.7.0	Exactly 3.7.0
^3.7	>=3.7.0 and <4.0.0 (recommended default)
~3.7.0	>=3.7.0 and <3.8.0
~3.7	>=3.7.0 and <4.0.0
3.7.*	Any 3.7.x
>=3.5 <3.8	A range (space or comma means AND)
^2.0 \|\| ^3.0	Either major version
dev-main	The main branch (needs suitable minimum-stability or @dev)

Pitfalls

Conflicts. If the requested version clashes with packages already locked, Composer stops with Your requirements could not be resolved to an installable set of packages. Add -W (--with-all-dependencies) to let it change other locked versions, or choose a version that fits.
PHP version and extensions. Packages declare the PHP version and extensions they need. A newer release may require a newer PHP than you run; the error names the platform requirement. Set config.platform.php in composer.json when the production PHP differs from your machine.
Unstable versions. Release candidates and branches are hidden by the default minimum-stability of stable; add @RC or @dev to the constraint for one package.
Exact pins block updates. An exact version (3.7.0) means composer update never moves it, including for security fixes. Prefer ^3.7 and rely on composer.lock for reproducibility.

How to confirm it worked

composer show monolog/monolog prints the installed version, and composer.json shows the constraint you asked for. Commit both composer.json and composer.lock; composer install vs composer update explains how other machines then install the same version.

FAQ

How do I add a development-only package?