From d6171f3e762cd5738423b25b635a499809fc8af0 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sat, 8 Aug 2026 08:21:32 +0300 Subject: [PATCH 1/4] Add Composer Dependency Analyser --- ...er.yml => composer-dependency-analyser.yml} | 12 +++++------- composer-dependency-analyser.php | 16 ++++++++++++++++ composer-require-checker.json | 18 ------------------ composer.json | 8 +++++--- docs/internals.md | 6 +++--- 5 files changed, 29 insertions(+), 31 deletions(-) rename .github/workflows/{composer-require-checker.yml => composer-dependency-analyser.yml} (57%) create mode 100644 composer-dependency-analyser.php delete mode 100644 composer-require-checker.json diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-dependency-analyser.yml similarity index 57% rename from .github/workflows/composer-require-checker.yml rename to .github/workflows/composer-dependency-analyser.yml index b97e6c291..eaa3762fe 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-dependency-analyser.yml @@ -1,4 +1,4 @@ -name: Composer require checker +name: composer dependency analyser on: pull_request: @@ -6,9 +6,9 @@ on: - 'src/**' - 'config/**' - 'tests/**' + - '.github/workflows/composer-dependency-analyser.yml' - 'composer.json' - - 'composer-require-checker.json' - - '.github/workflows/composer-require-checker.yml' + - 'composer-dependency-analyser.php' push: branches: ['master'] paths: *paths @@ -21,10 +21,8 @@ concurrency: cancel-in-progress: true jobs: - composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master + composer-dependency-analyser: + uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master with: - os: >- - ['ubuntu-latest'] php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php new file mode 100644 index 000000000..fb85e33a2 --- /dev/null +++ b/composer-dependency-analyser.php @@ -0,0 +1,16 @@ +disableComposerAutoloadPathScan() + ->setFileExtensions(['php']) + ->addPathToScan(__DIR__ . '/config', isDev: false) + ->addPathToScan(__DIR__ . '/src', isDev: false) + ->addPathToScan(__DIR__ . '/tests', isDev: true) + // View/WebView optionally accept a PSR-14 event dispatcher without requiring the package at runtime; + // previously whitelisted the same way in composer-require-checker.json. See "suggest" in composer.json. + ->ignoreErrorsOnPackages(['psr/event-dispatcher'], [ErrorType::SHADOW_DEPENDENCY]); diff --git a/composer-require-checker.json b/composer-require-checker.json deleted file mode 100644 index 74793614b..000000000 --- a/composer-require-checker.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "symbol-whitelist": [ - "Psr\\EventDispatcher\\StoppableEventInterface" - ], - "php-core-extensions": [ - "Core", - "date", - "json", - "hash", - "pcre", - "Phar", - "Reflection", - "SPL", - "random", - "standard" - ], - "scan-files": [] -} diff --git a/composer.json b/composer.json index 53a75aead..26aaee971 100644 --- a/composer.json +++ b/composer.json @@ -28,8 +28,10 @@ ], "require": { "php": "8.1 - 8.5", - "yiisoft/arrays": "^2.0 || ^3.0", + "psr/container": "^1.0 || ^2.0", + "yiisoft/aliases": "^3.1.1", "yiisoft/cache": "^1.0 || ^2.0 || ^3.0", + "yiisoft/definitions": "^3.4", "yiisoft/files": "^1.0 || ^2.0", "yiisoft/html": "^2.5 || ^3.0 || ^4.0", "yiisoft/json": "^1.0" @@ -37,12 +39,11 @@ "require-dev": { "bamarni/composer-bin-plugin": "^1.8.3", "friendsofphp/php-cs-fixer": "^3.93", - "maglnet/composer-require-checker": "^4.7.1", "phpbench/phpbench": "^1.4.3", "phpunit/phpunit": "^10.5.60", "rector/rector": "^2.3.4", + "shipmonk/composer-dependency-analyser": "^1.8", "spatie/phpunit-watcher": "^1.24.4", - "yiisoft/aliases": "^3.1.1", "yiisoft/code-style": "^1.0", "yiisoft/di": "^1.4.1", "yiisoft/psr-dummy-provider": "^1.0.2", @@ -86,6 +87,7 @@ "scripts": { "bench": "phpbench run", "cs-fix": "php-cs-fixer fix", + "dependency-analyser": "composer-dependency-analyser", "infection": "infection --threads=max", "test": "phpunit --testdox", "test-watch": "phpunit-watcher watch" diff --git a/docs/internals.md b/docs/internals.md index 4e7928cdd..774e8316e 100644 --- a/docs/internals.md +++ b/docs/internals.md @@ -36,11 +36,11 @@ use either newest or any specific version of PHP: ## Dependencies -This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if -all dependencies are correctly defined in `composer.json`. To run the checker, execute the following command: +Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown, +shadow, and unused [Composer](https://getcomposer.org) dependencies: ```shell -./vendor/bin/composer-require-checker +./vendor/bin/composer-dependency-analyser ``` ## Benchmarks From da6858a124f0a59cbe110be8c1d0a2e22a71600d Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 9 Aug 2026 15:02:28 +0300 Subject: [PATCH 2/4] fix --- composer-dependency-analyser.php | 5 ++++- composer.json | 1 - 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php index fb85e33a2..d86fa211a 100644 --- a/composer-dependency-analyser.php +++ b/composer-dependency-analyser.php @@ -13,4 +13,7 @@ ->addPathToScan(__DIR__ . '/tests', isDev: true) // View/WebView optionally accept a PSR-14 event dispatcher without requiring the package at runtime; // previously whitelisted the same way in composer-require-checker.json. See "suggest" in composer.json. - ->ignoreErrorsOnPackages(['psr/event-dispatcher'], [ErrorType::SHADOW_DEPENDENCY]); + ->ignoreErrorsOnPackages(['psr/event-dispatcher'], [ErrorType::SHADOW_DEPENDENCY]) + // `yiisoft/definitions` is used only in `config/di.php` and `config/di-web.php`, which are loaded by + // consumers using `yiisoft/di`, that already requires `yiisoft/definitions` itself. + ->ignoreErrorsOnPackages(['yiisoft/definitions'], [ErrorType::SHADOW_DEPENDENCY]); diff --git a/composer.json b/composer.json index 26aaee971..02d7cb43d 100644 --- a/composer.json +++ b/composer.json @@ -31,7 +31,6 @@ "psr/container": "^1.0 || ^2.0", "yiisoft/aliases": "^3.1.1", "yiisoft/cache": "^1.0 || ^2.0 || ^3.0", - "yiisoft/definitions": "^3.4", "yiisoft/files": "^1.0 || ^2.0", "yiisoft/html": "^2.5 || ^3.0 || ^4.0", "yiisoft/json": "^1.0" From cbe7e209d9d254bc1533a7458f026eeda71fa886 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 9 Aug 2026 19:45:32 +0300 Subject: [PATCH 3/4] fix --- composer-dependency-analyser.php | 16 +++++++++++++++- composer.json | 3 +-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php index d86fa211a..fb7780fa0 100644 --- a/composer-dependency-analyser.php +++ b/composer-dependency-analyser.php @@ -16,4 +16,18 @@ ->ignoreErrorsOnPackages(['psr/event-dispatcher'], [ErrorType::SHADOW_DEPENDENCY]) // `yiisoft/definitions` is used only in `config/di.php` and `config/di-web.php`, which are loaded by // consumers using `yiisoft/di`, that already requires `yiisoft/definitions` itself. - ->ignoreErrorsOnPackages(['yiisoft/definitions'], [ErrorType::SHADOW_DEPENDENCY]); + ->ignoreErrorsOnPackages(['yiisoft/definitions'], [ErrorType::SHADOW_DEPENDENCY]) + // `psr/container` is used only in `config/di.php`, which is loaded by consumers using `yiisoft/di`, + // that already requires `psr/container` itself. + ->ignoreErrorsOnPackageAndPaths( + 'psr/container', + [__DIR__ . '/config/di.php', __DIR__ . '/config/di-web.php'], + [ErrorType::SHADOW_DEPENDENCY], + ) + // `yiisoft/aliases` is used only in `config/di.php`, which is loaded by consumers using `yiisoft/di`, + // that already requires `yiisoft/aliases` itself. + ->ignoreErrorsOnPackageAndPaths( + 'yiisoft/aliases', + [__DIR__ . '/config/di.php', __DIR__ . '/config/di-web.php'], + [ErrorType::DEV_DEPENDENCY_IN_PROD], + ); diff --git a/composer.json b/composer.json index 02d7cb43d..2d6b4f0a3 100644 --- a/composer.json +++ b/composer.json @@ -28,8 +28,6 @@ ], "require": { "php": "8.1 - 8.5", - "psr/container": "^1.0 || ^2.0", - "yiisoft/aliases": "^3.1.1", "yiisoft/cache": "^1.0 || ^2.0 || ^3.0", "yiisoft/files": "^1.0 || ^2.0", "yiisoft/html": "^2.5 || ^3.0 || ^4.0", @@ -43,6 +41,7 @@ "rector/rector": "^2.3.4", "shipmonk/composer-dependency-analyser": "^1.8", "spatie/phpunit-watcher": "^1.24.4", + "yiisoft/aliases": "^3.1.1", "yiisoft/code-style": "^1.0", "yiisoft/di": "^1.4.1", "yiisoft/psr-dummy-provider": "^1.0.2", From 3763908c7d7acc594d1ce5efa900bf0595cd4e0f Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 9 Aug 2026 19:46:36 +0300 Subject: [PATCH 4/4] fix --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8b2f8ed2f..372d9316b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## 12.2.5 under development -- no changes in this release. +- Enh #313: Remove unused `yiisoft/arrays` dependency (@vjik) ## 12.2.4 March 18, 2026