In composer.json the license field is a string or an array of strings, using SPDX style names such as MIT or Apache-2.0. An array means a choice between licenses, not a requirement to meet all of them. The value proprietary marks closed source code. The field is optional, though the Composer schema highly recommends it.
What the schema says
Composer's documentation lists the recommended identifiers and points to the SPDX registry for more. A package that is closed source uses the string proprietary. When several licenses are listed in an array, the documentation calls it a disjunctive license, meaning the user can choose, for example LGPL-2.1-only or GPL-3.0-or-later. A single string can express the same choice with or inside parentheses. Licenses that must all apply are written with and inside parentheses.
This is the opposite of what many people assume when they see a list. Reading an array as an AND would make you overstate your obligations. Reading a missing field as permissive would understate them.
Reading the values
| Value | Meaning |
|---|---|
| MIT | One license |
| Array of two licenses | You may pick either |
| Parenthesized with and | You must meet both |
| proprietary | Closed source, no open license |
| Field absent | Unknown, check the repository |
Audit steps for a PHP project
- Use composer.lock to list every package and version, including indirect ones.
- Read each package's license value from its metadata.
- Treat arrays as choices and record which license you rely on.
- Treat proprietary as a contract question, not an open source one.
- For absent fields, read the LICENSE file in the repository and apply your unknown tier. See handling blank license fields.
- Add notices for what you distribute.
Dual license decisions
If a package offers two licenses and you pick one, write it down. A later audit then sees a deliberate choice, not an accident. See dual licensed packages.
PHP projects often pull in many small packages through frameworks, so the transitive set can be large. Do not stop at your own composer.json. The lock file is the record of what you actually install, and it is the right input for a license report. Re-run the report whenever the lock file changes, and keep the result with the release so you can answer a customer or auditor later without rebuilding old environments. If a package carries a license field that disagrees with its repository file, record both and ask the maintainer which is correct.
Safeguard scans dependencies from lockfiles and builds SBOMs. A free scan shows what a repository contains.
Quick check
Does an array of licenses mean I must follow all of them?
No. In Composer an array is a disjunctive choice. Use and inside parentheses for a combined requirement.
What does proprietary mean?
The package is closed source. Check your contract or agreement for use.
Sources
- Composer documentation, schema, license: https://getcomposer.org/doc/04-schema.md#license
Last reviewed: 19 October 2026.
