When running composer install without any flags, all dependencies are installed - including development packages that have no place in a production environment.

Security and Performance Implications

Running composer without proper flags in production creates several critical issues. Your production servers will contain unnecessary development packages, potentially exposing development tools in your production environment. This not only wastes disk space but can also impact your application's performance. More concerning is the potential security vulnerability from exposed debug information.

How to fix

If you've accidentally run composer install in Production Without --no-dev, remove all dependencies and perform a clean installation with production-specific flags:

rm -rf vendor/
composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader

Understanding the Flags

--no-dev ensures development dependencies are excluded from installation, keeping your production environment lean and secure.

--no-interaction prevents composer from asking interactive questions during the installation process, making it suitable for automated deployments.

--prefer-dist tells composer to use optimized package archives, improving installation performance.

--optimize-autoloader generates an optimized autoloader, enhancing your application's performance.

Deployment Automation

Include these flags in your deployment automation script (e. g. on Laravel Forge) to ensure consistent, secure deployments:

cd /path/to/project
git pull origin main
composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader

Verifying the Installation

You can verify that development packages are not installed by checking for the presence of development-only packages in your vendor directory, e.g.:

ls vendor/barryvdh/laravel-debugbar

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com