vivace is a Rust reimplementation of Composer's dependency management commands. Version 0.4.0 adds composer update, joining the existing composer install support introduced in earlier releases. The stated goal is byte-for-byte identical output: given the same composer.json and composer.lock, vivace produces the same vendor/ directory and the same lock file as Composer 2.10.3.

terminal
git clone https://github.com/Adelagric/vivace && cd vivace
cargo build --release
fixtures/make.sh
harness/update.sh
harness/diff-vendor.sh

Reaching that parity for update required porting Composer's actual resolver rather than writing a new algorithm from scratch. The author copied the pool builder, the pool optimizer, the rule set, the CDCL solver, the version policy and the lock writer. A different resolution algorithm would pick different package versions whenever the dependency graph is ambiguous, producing a lock file that cannot be diffed against Composer's own output.

Validation runs against frozen Packagist snapshots. The test compares the candidate pool first, then the full sequence of decisions the solver makes, read directly from Composer's internal Solver object, then the resulting operations and the final lock file. Test projects include Laravel, the Symfony demo application, Sylius, rector-src and a Drupal recommended-project, along with smaller synthetic cases built to trigger backtracking, an unsolvable dependency set, root aliases and virtual packages.

Anyone can verify the claim locally. Cloning the repository and running cargo build --release, then fixtures/make.sh to fetch the test projects, then harness/update.sh and harness/diff-vendor.sh compares vivace's output against real Composer runs. On an existing project, running vivace update --no-install next to composer update --no-install and diffing the two composer.lock files works the same way. The author treats any non-empty diff as a bug report.

vivace does not execute PHP scripts during install or update. It emulates three common Composer plugins, symfony/runtime, composer/installers and drupal/core-composer-scaffold, checking its emulation against the real plugin behavior; any other plugin causes vivace to fall back to running the actual composer binary. The tool does not yet support require or remove commands, partial updates such as composer update vendor/name, VCS or path repositories, Composer's diagnostic explanations for unsolvable dependency sets, or Windows. The project is hosted at github.com/Adelagric/vivace, with release notes in CHANGELOG.md and a list of untested scenarios in HANDOVER.md.