Composer is the preferred dependency management solution for PHP. List your project's dependencies in a composer.json file and, after issuing a few commands in the CLI, Composer will automatically download your project's dependencies and setup autoloading for you. Composer is analogous to NPM in the node.js world, or Bundler in the Ruby world.
Drupal core uses Composer to manage non-Drupal dependencies like Guzzle, and PHPUnit to name a few. Some (and more all the time) contributed modules also use Composer to integrate 3rd party PHP libraries into Drupal.
We recommend using Composer whenever possible to manage Drupal core and contributed module code for your projects. While it is not, strictly speaking, required to use Composer, doing so will prevent you from running into an issue where some contributed modules will not function properly if they are not installed via Composer.
Additionally, we generally recommend using Composer to download all of a project's dependencies, and then committing them to a single repository versus rebuilding the codebase for each deployment
- Install Drupal core from a Git repository clone
- Start a new Drupal site build
- Download a contributed Drupal module that includes a composer library
- Add a third-party PHP library as a dependency for your custom or contributed module
The way that Composer is used to manage Drupal sites, and project dependencies, isn't likely to change significantly. We anticipate that it will continue to become the standard. And that the documentation available on Drupal.org will stay up-to-date with current best practices.