adachsoft / project-validator-composer-json

v0.1.0 2026-11-12 20:40 UTC

Requires

• php: ^8.3
• adachsoft/project-validator: ^0.3

Requires (Dev)

• adachsoft/php-code-style: ^0.7.2
• friendsofphp/php-cs-fixer: ^3.95
• phpstan/phpstan: ^2.3
• phpunit/phpunit: ^12.5
• rector/rector: ^2.8
• symplify/phpstan-rules: ^14.19

MIT

• AdachSoft

• composer
• validation
• project

Published on Packagist.org on 2026-11-12 19:40 UTC

README

adachsoft/project-validator-composer-json adds release-risk checks for Composer library manifests to applications built on adachsoft/project-validator.

Features

• Reports invalid JSON and explicit root version fields.
• Detects wildcard (*) and development dependency constraints.
• Optionally checks require-dev and supports an allow-list of packages.
• Ignores platform requirements such as php, ext-*, and lib-*.

Only manifests with type: library or no type field are checked.

Requirements

• PHP 8.3 or later
• adachsoft/project-validator ^0.3

Installation

composer require adachsoft/project-validator-composer-json

Usage

Register AdachSoft\ProjectValidatorComposerJson\ComposerJsonValidator as a ProjectValidatorInterface implementation in the host application's validator registry. Its default validator code is composer_json. The host application supplies a ValidationContextInterface when checking support and running validation.

The include_require_dev option enables checks for require-dev and defaults to false. The allowed_packages option accepts a list of dependency names exempt from dependency checks and defaults to an empty list. See the usage example for registration and options.