- What is ComposerRequireChecker and what problem does it solve?
- ComposerRequireChecker is a standalone PHP CLI tool that analyzes your source code and composer.json to find symbols that are used but not declared as direct Composer requirements. It catches soft or transitive dependencies, including PHP functions that require an extension you did not explicitly require. This prevents code from breaking when a transitive dependency changes or is removed.
- How do I install and run ComposerRequireChecker for a Laravel project?
- The preferred approach is a pinned PHAR, with PHIVE and global Composer installs also supported. After composer install, run php composer-require-checker.phar check /path/to/composer.json from CI or a local tooling environment. Disable Xdebug before running, since it is not needed and can slow the scan. Do not install it as a project dependency.
- Does ComposerRequireChecker work with Laravel applications and packages?
- Yes. It is framework-agnostic and works well for Laravel apps and packages because they are Composer-driven, and it will catch undeclared package usage in application code. It does not understand Laravel-specific semantics beyond PHP symbols and autoloaded files, so facades, container-resolved classes, and dynamic calls may require justified whitelist entries.
- Which PHP and Laravel versions does ComposerRequireChecker support?
- The tool tracks PHP runtime support in its own releases, so version pinning matters. For example, release 4.19 dropped PHP 8.2 support and 4.21 dropped PHP 8.3 support for symfony/console v8 compatibility. If your Laravel app runs an older PHP version, run the checker in a separate newer PHP container or pin an older tool release that supports your CI runtime. Laravel version support is effectively driven by the PHP version Composer resolves.
- Should I add maglnet/composer-require-checker as a Composer dev dependency?
- No. ComposerRequireChecker is intentionally not supposed to be installed as part of your project dependencies. Use a pinned PHAR, PHIVE, or a global Composer install and treat it as a CI tooling artifact. This avoids dependency conflicts and keeps it out of production installs. Pin the version and verify checksums or mirror the PHAR internally to reduce supply-chain risk.
- How do I configure the whitelist and scan-files in composer-require-checker.json?
- Configuration is JSON-based and supports whitelist entries plus scan-files paths for code outside standard autoloading. The default whitelist covers PHP core symbols and extensions, and custom configs must copy the whole default sections rather than adding only deltas. Add only justified Laravel or project-specific entries, and reserve whitelist entries for tool limitations or genuinely intentional symbols.
- Why does ComposerRequireChecker report false positives in Laravel code?
- Static analysis cannot always see dynamically constructed class names, framework magic, or symbols resolved only at runtime, so false positives are possible. Use the whitelist for tool limitations rather than blanket suppression, and prefer fixing real soft dependencies with explicit composer require declarations. ComposerRequireChecker complements PHPStan or Psalm because its focus is dependency declaration hygiene, not type or code correctness.
- How do I run ComposerRequireChecker in CI as a dependency gate?
- Add a CI job that runs after composer install and executes the checker against composer.json, starting as non-blocking while you triage and baseline findings. Fix real soft dependencies and then make the gate blocking for new violations before enforcing a fully clean baseline. If a project uses custom installer plugins, use the documented composer install --no-plugins workaround in an isolated scan job. Pin the tool version to match the PHP runtime used by CI.
- How is ComposerRequireChecker different from PHPStan, Psalm, or composer-unused?
- ComposerRequireChecker focuses specifically on whether symbols used by your code are declared as direct Composer requirements, including extension-provided functions. PHPStan and Psalm focus on type and code correctness, while composer-unused looks for declared dependencies that are not used. The tools are complementary: run ComposerRequireChecker to enforce dependency declaration hygiene alongside your existing static analysis.
- Is ComposerRequireChecker actively maintained, and what alternatives exist?
- The open-source project appears actively maintained, with release cadence that includes PHP-version support changes, but there is no commercial SLA. Alternatives include composer-unused for unused dependency detection and general static analysis tools such as PHPStan or Psalm, though they address different problems. Plan for whitelist drift and assign an owner for exception review, because maintaining the whitelist is the main long-term process risk.