From b71d365df6d534c3ead8f7f4edb2db10c75d650e Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sat, 8 Aug 2026 08:20:20 +0300 Subject: [PATCH 1/3] Add Composer Dependency Analyser --- ...r.yml => composer-dependency-analyser.yml} | 20 +++++++++---------- composer-dependency-analyser.php | 20 +++++++++++++++++++ composer-require-checker.json | 15 -------------- composer.json | 6 +++++- docs/internals.md | 9 ++++----- 5 files changed, 39 insertions(+), 31 deletions(-) rename .github/workflows/{composer-require-checker.yml => composer-dependency-analyser.yml} (52%) create mode 100644 composer-dependency-analyser.php delete mode 100644 composer-require-checker.json diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-dependency-analyser.yml similarity index 52% rename from .github/workflows/composer-require-checker.yml rename to .github/workflows/composer-dependency-analyser.yml index 4dcc19e19..c6ebea2b2 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-dependency-analyser.yml @@ -1,28 +1,28 @@ +name: composer dependency analyser + on: pull_request: paths: &paths + - 'config/**' - 'src/**' - - '.github/workflows/composer-require-checker.yml' + - 'tests/**' + - '.github/workflows/composer-dependency-analyser.yml' - 'composer.json' - - 'composer-require-checker.json' - + - 'composer-dependency-analyser.php' push: branches: ['master'] paths: *paths -name: Composer require checker +permissions: + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: - contents: read jobs: - composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master + composer-dependency-analyser: + uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] - required-packages: >- - ['db'] diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php new file mode 100644 index 000000000..bc59fdae6 --- /dev/null +++ b/composer-dependency-analyser.php @@ -0,0 +1,20 @@ +disableComposerAutoloadPathScan() + ->setFileExtensions(['php']) + ->addPathToScan(__DIR__ . '/config', isDev: false) + ->addPathToScan(__DIR__ . '/src', isDev: false) + ->addPathToScan(__DIR__ . '/tests', isDev: true) + // These are optional (suggested) dependencies used unconditionally in opt-in traits; + // consumers who don't `use` the trait don't need the package. See the "suggest" section + // in composer.json. + ->ignoreErrorsOnPackages( + ['yiisoft/arrays', 'yiisoft/event-dispatcher', 'yiisoft/factory'], + [ErrorType::DEV_DEPENDENCY_IN_PROD], + ); diff --git a/composer-require-checker.json b/composer-require-checker.json deleted file mode 100644 index 2acdbca6a..000000000 --- a/composer-require-checker.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "symbol-whitelist": [ - "Psr\\EventDispatcher\\EventDispatcherInterface", - "Psr\\EventDispatcher\\StoppableEventInterface", - "Psr\\Http\\Message\\ResponseInterface", - "Psr\\Http\\Message\\ServerRequestInterface", - "Psr\\Http\\Server\\MiddlewareInterface", - "Psr\\Http\\Server\\RequestHandlerInterface", - "Yiisoft\\Arrays\\ArrayableTrait", - "Yiisoft\\EventDispatcher\\Dispatcher\\Dispatcher", - "Yiisoft\\EventDispatcher\\Provider\\ListenerCollection", - "Yiisoft\\EventDispatcher\\Provider\\Provider", - "Yiisoft\\Factory\\Factory" - ] -} diff --git a/composer.json b/composer.json index 0c0766f7e..d7ad8b937 100644 --- a/composer.json +++ b/composer.json @@ -28,15 +28,18 @@ ], "require": { "php": "8.1 - 8.5", + "psr/container": "^1.0 || ^2.0", + "psr/event-dispatcher": "^1.0", "yiisoft/db": "^2.0" }, "require-dev": { "ext-pdo": "*", "bamarni/composer-bin-plugin": "^1.8.3", "friendsofphp/php-cs-fixer": "^3.89.1", - "maglnet/composer-require-checker": "^4.7.1", "phpunit/phpunit": "^10.5.58", + "psr/simple-cache": "^2.0|^3.0", "rector/rector": "^2.2.3", + "shipmonk/composer-dependency-analyser": "^1.8", "spatie/phpunit-watcher": "^1.24", "yiisoft/arrays": "^3.2", "yiisoft/db-mssql": "^2.0", @@ -93,6 +96,7 @@ } }, "scripts": { + "dependency-analyser": "composer-dependency-analyser", "test": "phpunit --testdox --no-interaction", "test-watch": "phpunit-watcher watch" } diff --git a/docs/internals.md b/docs/internals.md index a3621f962..c7220be8a 100644 --- a/docs/internals.md +++ b/docs/internals.md @@ -107,12 +107,11 @@ use either newest or any specific version of PHP: ./vendor/bin/rector ``` -## Composer require checker +## Dependencies -This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if all dependencies are correctly defined in `composer.json`. - -To run the checker, execute the following command: +Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown, +shadow, and unused [Composer](https://getcomposer.org) dependencies: ```shell -./vendor/bin/composer-require-checker +./vendor/bin/composer-dependency-analyser ``` From 857b7204f5e050686b3cac2baf30541113a69d86 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sat, 8 Aug 2026 13:56:55 +0300 Subject: [PATCH 2/3] fix --- composer-dependency-analyser.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php index bc59fdae6..dba685f24 100644 --- a/composer-dependency-analyser.php +++ b/composer-dependency-analyser.php @@ -5,7 +5,7 @@ use ShipMonk\ComposerDependencyAnalyser\Config\Configuration; use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType; -return (new Configuration()) +$config = (new Configuration()) ->disableComposerAutoloadPathScan() ->setFileExtensions(['php']) ->addPathToScan(__DIR__ . '/config', isDev: false) @@ -18,3 +18,11 @@ ['yiisoft/arrays', 'yiisoft/event-dispatcher', 'yiisoft/factory'], [ErrorType::DEV_DEPENDENCY_IN_PROD], ); + +if (PHP_VERSION_ID < 80200) { + // Native PHP attribute available since PHP 8.2; not autoloadable on lower PHP versions, + // which are still within the supported range (see "php" in composer.json). + $config->ignoreUnknownClasses(['AllowDynamicProperties']); +} + +return $config; From 763e2da81c2e98a10f70ec8779ce3f3d58e0ea29 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sat, 8 Aug 2026 14:23:16 +0300 Subject: [PATCH 3/3] fix --- composer-dependency-analyser.php | 13 +++++++++++++ composer.json | 2 -- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php index dba685f24..5ca7d636a 100644 --- a/composer-dependency-analyser.php +++ b/composer-dependency-analyser.php @@ -17,6 +17,19 @@ ->ignoreErrorsOnPackages( ['yiisoft/arrays', 'yiisoft/event-dispatcher', 'yiisoft/factory'], [ErrorType::DEV_DEPENDENCY_IN_PROD], + ) + // psr/event-dispatcher is the PSR interface backing the optional yiisoft/event-dispatcher + // integration above; it's only needed when a consumer wires that integration up. + ->ignoreErrorsOnPackages( + ['psr/event-dispatcher'], + [ErrorType::SHADOW_DEPENDENCY], + ) + // config/bootstrap.php is only invoked by a DI container, so a PSR-11 implementation + // is always present at runtime even though this package doesn't require one itself. + ->ignoreErrorsOnPackageAndPath( + 'psr/container', + __DIR__ . '/config/bootstrap.php', + [ErrorType::SHADOW_DEPENDENCY], ); if (PHP_VERSION_ID < 80200) { diff --git a/composer.json b/composer.json index d7ad8b937..8430b3d75 100644 --- a/composer.json +++ b/composer.json @@ -28,8 +28,6 @@ ], "require": { "php": "8.1 - 8.5", - "psr/container": "^1.0 || ^2.0", - "psr/event-dispatcher": "^1.0", "yiisoft/db": "^2.0" }, "require-dev": {