Composer Require Checker Laravel Package

Product Decisions This Supports

• Dependency hygiene policy: Decide whether the team treats transitive/soft dependencies as acceptable risk or enforces explicit composer.json requirements. This tool turns that policy into an automatable check.
• Build vs. buy: Avoid building custom Composer dependency-usage analysis. Use an MIT-licensed CLI that already parses PHP symbols, Composer metadata, PHP extensions, and configuration.
• Release readiness gates: Add a CI check before releases to catch code that relies on packages not declared as direct dependencies, reducing the chance that a dependency update breaks production.
• Laravel/PHP upgrade planning: Use scan results during framework or package upgrades to identify implicit dependencies that may shift when Laravel packages update their own dependencies.
• Package and library maintenance: For teams publishing Laravel/PHP packages, validate that consumers will install every extension and library the package actually uses.
• Vendor and platform risk management: Detect reliance on PHP extensions that are not explicitly required, which is useful when planning deployment images and platform requirements.
• Roadmap input: Decide whether to invest in stronger dependency governance, CI quality gates, or broader software composition analysis. This package is a narrow, low-cost step before larger SCA/CVE tooling.

When to Consider This Package

• Your product is a PHP/Composer-based application or library, especially Laravel projects with many direct and transitive dependencies.
• You have CI and want a fast, deterministic check that source code only references declared dependencies.
• You maintain packages or shared libraries where accidental soft dependencies create downstream breakage.
• You are preparing a major Laravel/PHP upgrade and need visibility into implicit dependency coupling.
• You want a low-integration tool: PHAR, PHIVE, or global Composer install; no application code changes required.
• You need to catch missing PHP extension requirements in addition to missing Composer packages.

Look elsewhere or defer adoption when:

• The codebase is not PHP/Composer-based.
• You need runtime dependency monitoring, vulnerability scanning, license compliance, or full software composition analysis. This is not an SCA/CVE platform.
• Your build depends heavily on custom Composer installer plugins that place code outside vendor/; the README documents a workaround, but it adds CI complexity.
• You cannot run a post-composer install scan in CI or locally.
• You expect framework-native Laravel integration. This is a standalone CLI, not a Laravel package with service providers or runtime hooks.
• Your organization requires a highly mature, widely embedded tool with strong commercial support; evaluate maturity and maintainer capacity against your risk tolerance.

How to Pitch It (Stakeholders)

For executives: This is a low-cost, MIT-licensed quality gate for PHP/Laravel products. It prevents a common failure mode: code silently depends on a package installed only because another dependency brought it in. When that transitive package changes, production can break. The tool makes those hidden dependencies visible and enforceable in CI, reducing release risk without changing application code.

For engineering: Adopt it as a CI check after composer install. Run the PHAR or PHIVE-managed binary against composer.json, tune the config only where needed, and fail builds on unknown symbols. It catches missing direct Composer requirements and missing PHP extensions. It does not install dependencies, modify code, or replace PHPStan/Psalm or security scanners. Start with a non-blocking pilot on one Laravel service or package, fix findings by adding explicit requirements, then make it a required check. Note the README guidance to disable Xdebug for performance and to handle custom installer plugins via composer install --no-plugins if necessary.

Recommendation: Pilot in CI for one high-value PHP/Laravel repository. If findings are actionable and false positives are manageable, standardize it as a dependency-governance gate and pair it with existing static analysis and security tooling.