Composer Require Checker Laravel Package

Product Decisions This Supports

• Dependency Hygiene & Risk Mitigation:

  • Enforce explicit dependency declarations to eliminate "soft" (transitive) dependencies, reducing risk of breaking changes during updates.
  • Align with Defensive Dependency Management initiatives (e.g., "fail fast" on implicit dependencies).

• Developer Experience (DX) & CI/CD Integration:

  • Pre-commit/pre-merge hooks: Block PRs with soft dependencies via GitHub Actions or GitLab CI.
  • Onboarding: Automate dependency checks for new contributors to prevent technical debt.
  • Legacy Code Refactoring: Identify and resolve hidden dependencies during modernization efforts (e.g., PHP 7.x → 8.x).

• Build vs. Buy:

  • Buy: Justify tooling investment by quantifying risk reduction (e.g., "X% fewer breaking changes post-adoption").
  • Custom Alternative: Only build if the package lacks critical features (e.g., support for custom Composer plugins or niche PHP extensions).

• Use Cases:

  • Open-Source Projects: Enforce maintainable dependency graphs for downstream consumers.
  • Enterprise Monorepos: Scan microservices to detect shared but undeclared dependencies.
  • Security Audits: Flag dependencies with known vulnerabilities (e.g., via composer why-not + this tool).

When to Consider This Package

Adopt if:

• Your project uses Composer and has non-trivial dependency trees (e.g., >50 packages or complex transitive graphs).
• You prioritize stability over convenience (e.g., SaaS backends, financial systems, or long-lived projects).
• Your team lacks explicit dependency reviews in PRs or lacks tooling for dependency hygiene.
• You need to audit PHP extensions (e.g., intl, gd) or PHP core functions (e.g., json_decode) for missing require declarations.

Look elsewhere if:

• Your project is tiny (e.g., <10 files, no composer.json).
• You rely on custom Composer plugins that install files outside vendor/ (workaround exists but adds friction).
• You need real-time IDE warnings (consider PHPStan or Psalm instead).
• Your team prefers manual dependency management (e.g., "we’ll handle updates in a meeting").

How to Pitch It (Stakeholders)

For Executives:

"This tool acts like a ‘dependency spellchecker’ for PHP projects. Right now, our code might silently rely on libraries we didn’t explicitly ask for—like using a coffee machine that’s actually powered by the printer’s cord. If the printer gets updated, our coffee stops working. This tool flags those risks early, so we avoid costly surprises during updates. For example, [Project X] could reduce dependency-related bugs by ~30% (based on similar tools in other ecosystems) with minimal effort. It’s a $0 cost, high-ROI fix for technical debt."

Ask: "Would you prioritize preventing production incidents over saving dev time on manual dependency reviews?"

For Engineering Leaders:

*"ComposerRequireChecker solves two critical pain points:

1. Hidden Dependencies: It catches ‘soft’ dependencies (e.g., using guzzlehttp/guzzle because thatvendor/api-lib pulled it in) that break when transitive deps update.
2. PHP Extension Gaps: Flags missing require for extensions like intl or pdo_mysql before runtime errors.

Why now?

• CI Integration: Add a 2-minute scan to PR checks (example GitHub Action).
• Audit Trail: Generate reports for security/compliance reviews (e.g., ‘All dependencies are explicitly declared’).
• Low Friction: Runs in <1 minute on most repos; config is optional.

Tradeoff: False positives may require config tweaks, but the default whitelist covers 90% of cases. We’ve used this internally on [Project Y] to eliminate 12 breaking changes in the last 6 months."*

Ask: "Should we gate PR merges on this check, or start with a weekly audit?"

For Developers:

*"Imagine you write code using Guzzle because it’s ‘already installed.’ Later, the library that actually required Guzzle updates, and your code breaks. This tool prevents that by scanning your code for:

• Undeclared classes/functions (e.g., use GuzzleHttp\Psr7\Stream; without guzzlehttp/psr7 in composer.json).
• Missing PHP extensions (e.g., file_get_contents() with allow_url_fopen off).

How to use it:

1. Install once (global Composer or PHAR):

   composer global require maglnet/composer-require-checker
   

2. Run in your project:

   composer-require-checker check
   

3. Fix errors by adding missing require entries to composer.json.

Pro Tip: Add it to your composer.json scripts:

"scripts": {
  "post-autoload-dump": "composer-require-checker check"
}

to catch issues during composer install."*

Ask: "Who wants to try this on their PR next week?"