Repository navigation
The first public release of Phast, a fast dependency manager for PHP, written in Rust.
This is a beta. It installs real projects from Packagist today, but the manifest and lock formats may still change before 1.0.
Feedback and issues are very welcome.
Install
Linux and macOS:
curl -fsSL https://raw.githubusercontent.com/phast-sh/phast/main/install.sh | shThen run phast install in any Composer project. Your composer.json works as is.
Prebuilt binaries are attached below for x86_64 and aarch64 on Linux (musl, statically linked) and macOS, each with a .sha256 checksum.
What's in it
- Fast installs. Downloads and extraction run in parallel, so cold installs are quick
and repeat installs are nearly instant. - Composer-compatible. Installs from Packagist, Private Packagist and Satis, reads your
existingcomposer.json, and generates avendor/autoload.phpyour application uses
exactly as before,\Composer\InstalledVersionsincluded. - TOML-first, if you want it.
phast migrateconvertscomposer.jsoninto a readable
phast.toml, andphast.lockkeeps a stable order so diffs stay small. - Scripts.
phast runruns named scripts, and Composer lifecycle events
(pre-install-cmd,post-update-cmd, ...) fire automatically. - Errors that explain. A resolution conflict says which requirement conflicts with
which, and which package pulled it in. - Workspaces. Monorepos with one lock file and one
vendor/, no path-repository wiring. - Secure by default. Lock file checksums, a
minimum-package-ageguard, and
phast auditagainst Packagist and OSV advisories.
Numbers
On koel, a real app with 202 packages. Median of 5 runs, same machine, scripts off, isolated caches:
cold install (no lock, no cache) Phast 7.00s Composer 67.32s
from a lock, empty cache (CI) Phast 5.20s Composer 17.17s
warm cache Phast 2.16s Composer 7.41s
nothing to do Phast 0.53s Composer 3.12s
The benchmark script and the raw runs are in testing/perf/.
Links
- Documentation: https://docs.phast.sh
- Security policy: SECURITY.md