CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package
- dev-master / 1.1.x-dev
A CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package.
This will prevent you from using "soft" dependencies that are not defined within your
composer.json require section.
Your code most certainly uses external dependencies. And if it's only extending PHPUnits
TestCase. And to make sure that your code knows where to find that
TestCase-class you for sure called
composer require --dev phpunit/phpunit. That means your dependency is a hard dependency.
But what if you did a
composer require phpunit/dbunit? As that package requires phpunit/phpunit as well all your dependencies would still work, wouldn't they? But only out of sheer luck (and in this far fetched example because it's the way it's designed). But from your
composer.json one wouldn't immediately know that you'd use PHPUnits
TestCase-class. That's what a "soft dependency" is. And you should avoid those as they might blow. Imagine the person maintaining the library that also includes the package that you depend on suddenly using a completely different library. Suddenly your code would break after a
composer update for no apparent reason. Just because you didn't include the dependency as a "first level" dependency in the first place.
This CLI-Tool parses your code and your composer.json-file to see whether your code contains such "soft dependencies" that might break your code.
Composer require checker is not supposed to be installed as part of your project dependencies.
Please check the releases for available phar files. Download the latest release and and run it like this:
php composer-require-checker.phar check /path/to/your/project/composer.json
If you already use PHIVE to install and manage your project’s tooling, then you should be able to simply install ComposerRequireChecker like this:
phive install composer-require-checker
This package can be easily globally installed by using Composer:
composer global require maglnet/composer-require-checker
If you haven't already setup you composer installation to support global requirements, please refer to the Composer cli - global If this is already done, run it like this:
composer-require-checker check /path/to/your/project/composer.json
Composer require checker is configured to whitelist some symbols per default. Have a look at the config file example to see which configuration options are available.
You can now adjust this file, as needed, and tell composer-require-checker to use it for it's configuration.
bin/composer-require-checker check --config-file=path/to/config.json /path/to/your/project/composer.json
To scan files, that are not part of your autoload definition you may add glob patterns to the config file's
The following example would also scan the file
bin/console and all files with
.php extension within your
"scan-files" : ["bin/console", "bin/*.php"]
This package is made available under the MIT LICENSE.