Phast 0.1.0 Ai-Petri: now in beta

The Phast beta is out. Version 0.1.0 is the first public release. It installs real projects from Packagist today, but the manifest and lock formats may still change before 1.0.

Phast is a dependency manager for PHP, written in Rust. It reads your existing composer.json, installs from Packagist, Private Packagist or Satis, and generates a vendor/autoload.php your application uses exactly as before, \Composer\InstalledVersions included. Nothing in your project has to change to try it.

Try it

On Linux and macOS:

curl -fsSL https://raw.githubusercontent.com/phast-sh/phast/main/install.sh | sh

Then run phast install in any Composer project.

What it brings

If you want to, phast migrate turns your composer.json into a TOML manifest, phast.toml. It’s easier to read, and you can finally leave a comment next to a requirement saying why it’s pinned. The lock file keeps a stable order, so diffs stay small and merge conflicts rare.

Monorepos get native workspaces, with one lock file and one vendor/ for every member, and no path-repository wiring to maintain.

There are supply-chain guards built in. The lock file records checksums, a minimum-package-age setting holds back freshly published releases, and phast audit checks your dependencies against both Packagist and OSV advisories.

When resolution fails, the errors explain which requirement conflicts with which, and which package pulled it in. And scripts work as you’d expect. phast run runs them by name, and Composer’s lifecycle events fire as they always have.

And it’s fast. On koel, a real app with 202 packages, a cold install takes 7.0s against Composer’s 67.3s, and an install from a lock with an empty cache, the one CI runs on every pipeline, 5.2s against 17.2s. The benchmark script and the raw runs are in the repository, so you can check it on your own projects.

What’s missing

The biggest gap is plugins, since Composer plugins don’t run under Phast yet. Plugin support is planned, and I’m still working out the best way to approach it. The direction I’m leaning towards is plugins you opt into explicitly, each running in its own process, rather than inside the package manager. There’s no Windows build yet either.

What’s next

The next release, 0.1.1, focuses on the things a first user is likely to run into. It brings fixes found since the launch, closes a few supply-chain gaps, and runs the rest of the test suite in CI. New releases will be announced here.

If you try Phast, I’d love to hear how it went, especially if something breaks. Just open an issue.