Phast is a dependency manager for PHP, written in Rust. It reads your existing composer.json, installs from Packagist,
Private Packagist or Satis, and generates a vendor/autoload.php your application uses exactly as before,
\Composer\InstalledVersions included. Nothing in your project has to change to try it.
On Linux and macOS:
curl -fsSL https://raw.githubusercontent.com/phast-sh/phast/main/install.sh | sh
Then run phast install in any Composer project.
If you want to, phast migrate turns your composer.json into a TOML manifest, phast.toml. It’s easier to read,
and you can finally leave a comment next to a requirement saying why it’s pinned. The lock file keeps a stable
order, so diffs stay small and merge conflicts rare.
Monorepos get native workspaces, with one lock file and one vendor/ for every member, and no path-repository
wiring to maintain.
There are supply-chain guards built in. The lock file records checksums, a minimum-package-age setting
holds back freshly published releases, and phast audit checks your dependencies against both Packagist and OSV
advisories.
When resolution fails, the errors explain which requirement conflicts with which, and which package pulled it in.
And scripts work as you’d expect. phast run runs them by name, and Composer’s lifecycle events fire as they always
have.
And it’s fast. On koel, a real app with 202 packages, a cold install takes 7.0s against Composer’s 67.3s, and an install from a lock with an empty cache, the one CI runs on every pipeline, 5.2s against 17.2s. The benchmark script and the raw runs are in the repository, so you can check it on your own projects.
The biggest gap is plugins, since Composer plugins don’t run under Phast yet. Plugin support is planned, and I’m still working out the best way to approach it. The direction I’m leaning towards is plugins you opt into explicitly, each running in its own process, rather than inside the package manager. There’s no Windows build yet either.
The next release, 0.1.1, focuses on the things a first user is likely to run into. It brings fixes found since the launch, closes a few supply-chain gaps, and runs the rest of the test suite in CI. New releases will be announced here.
If you try Phast, I’d love to hear how it went, especially if something breaks. Just open an issue.