Add Composer Dependency Analyser

.github/workflows/composer-require-checker.yml → .github/workflows/composer-dependency-analyser.yml

@@ -1,14 +1,14 @@
-name: Composer require checker
+name: composer dependency analyser
 
 on:
   pull_request:
     paths: &paths
       - 'src/**'
       - 'config/**'
       - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
       - 'composer.json'
-      - 'composer-require-checker.json'
-      - '.github/workflows/composer-require-checker.yml'
+      - 'composer-dependency-analyser.php'
   push:
     branches: ['master']
     paths: *paths
@@ -21,10 +21,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  composer-require-checker:
-    uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
     with:
-      os: >-
-        ['ubuntu-latest']
       php: >-
         ['8.1', '8.2', '8.3', '8.4', '8.5']

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## 12.2.5 under development
 
-- no changes in this release.
+- Enh #313: Remove unused `yiisoft/arrays` dependency (@vjik)
 
 ## 12.2.4 March 18, 2026
 

composer-dependency-analyser.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/config', isDev: false)
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true)
+    // View/WebView optionally accept a PSR-14 event dispatcher without requiring the package at runtime;
+    // previously whitelisted the same way in composer-require-checker.json. See "suggest" in composer.json.
+    ->ignoreErrorsOnPackages(['psr/event-dispatcher'], [ErrorType::SHADOW_DEPENDENCY])
+    // `yiisoft/definitions` is used only in `config/di.php` and `config/di-web.php`, which are loaded by
+    // consumers using `yiisoft/di`, that already requires `yiisoft/definitions` itself.
+    ->ignoreErrorsOnPackages(['yiisoft/definitions'], [ErrorType::SHADOW_DEPENDENCY])
+    // `psr/container` is used only in `config/di.php`, which is loaded by consumers using `yiisoft/di`,
+    // that already requires `psr/container` itself.
+    ->ignoreErrorsOnPackageAndPaths(
+        'psr/container',
+        [__DIR__ . '/config/di.php', __DIR__ . '/config/di-web.php'],
+        [ErrorType::SHADOW_DEPENDENCY],
+    )
+    // `yiisoft/aliases` is used only in `config/di.php`, which is loaded by consumers using `yiisoft/di`,
+    // that already requires `yiisoft/aliases` itself.
+    ->ignoreErrorsOnPackageAndPaths(
+        'yiisoft/aliases',
+        [__DIR__ . '/config/di.php', __DIR__ . '/config/di-web.php'],
+        [ErrorType::DEV_DEPENDENCY_IN_PROD],
+    );

composer.json

@@ -28,7 +28,6 @@
     ],
     "require": {
         "php": "8.1 - 8.5",
-        "yiisoft/arrays": "^2.0 || ^3.0",
         "yiisoft/cache": "^1.0 || ^2.0 || ^3.0",
         "yiisoft/files": "^1.0 || ^2.0",
         "yiisoft/html": "^2.5 || ^3.0 || ^4.0",
@@ -37,10 +36,10 @@
     "require-dev": {
         "bamarni/composer-bin-plugin": "^1.8.3",
         "friendsofphp/php-cs-fixer": "^3.93",
-        "maglnet/composer-require-checker": "^4.7.1",
         "phpbench/phpbench": "^1.4.3",
         "phpunit/phpunit": "^10.5.60",
         "rector/rector": "^2.3.4",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "spatie/phpunit-watcher": "^1.24.4",
         "yiisoft/aliases": "^3.1.1",
         "yiisoft/code-style": "^1.0",
@@ -86,6 +85,7 @@
     "scripts": {
         "bench": "phpbench run",
         "cs-fix": "php-cs-fixer fix",
+        "dependency-analyser": "composer-dependency-analyser",
         "infection": "infection --threads=max",
         "test": "phpunit --testdox",
         "test-watch": "phpunit-watcher watch"

docs/internals.md

@@ -36,11 +36,11 @@ use either newest or any specific version of PHP:
 
 ## Dependencies
 
-This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if
-all dependencies are correctly defined in `composer.json`. To run the checker, execute the following command:
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
 
 ```shell
-./vendor/bin/composer-require-checker
+./vendor/bin/composer-dependency-analyser
 ```
 
 ## Benchmarks