Custom module with composer dependencies

I’m using silverstripe 4.12 (core + cms).

How do I manage dependencies in a custom module (custom as in, not a real github repo or composer package)?

My module is inside vendor/johndoe/base. It has a composer.json that I created myself with 4 dependencies inside it. 3 of these are third party modules which I would like to be installed like tractorcow/silverstripe-fluent.

    "name": "johndoe/base",
    "description": "Add base code and configs to johndoe's website",
    "type": "silverstripe-vendormodule",
    "require": {
        "silverstripe/framework": "^4",
        "phpmailer/phpmailer": "^6.5",
        "tractorcow/silverstripe-fluent": "^5",
        "symbiote/silverstripe-gridfieldextensions": "^3"
    "minimum-stability": "dev",
    "prefer-stable": true

In an ideal situation (this module being a github repo) I would go to the webroot, execute composer require johndoe/base and it would just get all the third party modules (like tractorcow/silverstripe-fluent). However since my module is just a “fake” module, it won’t do this.

I thought I could fix this by just going to vendor/johndoe/base and execute composer update there, but that brought in a lot of mess by installing the SS framework inside that module folder.

Back to my question: How can I have all these third party dependencies installed in the right spot with just one command from webroot?

You’ve kind-of answered your own question… why not just put it in a github repo? You can then do what you need. It can be installed from any location, including from deployment servers, etc. You don’t really want to be manually adding anything to the vendor directory… it’ll end badly at some point!

If you don’t mind having it publicly available, you can either publish it on packagist, or you can just put the reference in your main composer.json file to tell the project where to find the code, eg:

    "repositories": [
            "type": "vcs",
            "url": ""

You can also set repository sources up from local drives, etc. as well if you really need to, and there are also ways to pull code from private repos. So a few options really.

Thank you Tim! However it’s not the type of module I want to publish on GitHub. It’s closed source.

composer can be used with local VCS repositories just as well. Another option would be to skip composer altogether and copy (or symlink) the module directory in your project root, as done in pre-composer Silverstripe.

Yes, if this is just for a single project, you can just have the module in a directory in the root. Change the module type from silverstripe-vendormodule to silverstripe-module in the composer file, and make sure you have a directory in there called _config and it should get picked up.

As I say, you can pull from a private repository too… have a look at the composer website for details.