PHPackages maglnet/composer-require-checker - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Testing & Quality](/categories/testing) 4. / 5. maglnet/composer-require-checker ActiveLibrary[Testing & Quality](/categories/testing) maglnet/composer-require-checker ================================ CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package 4.24.0(1mo ago)99810.9M—2.2%77[10 issues](https://github.com/maglnet/ComposerRequireChecker/issues)[11 PRs](https://github.com/maglnet/ComposerRequireChecker/pulls)20MITPHPPHP ~8.4.0 || ~8.5.0CI passing Since Dec 1Pushed 2mo ago9 watchersCompare [ Source](https://github.com/maglnet/ComposerRequireChecker)[ Packagist](https://packagist.org/packages/maglnet/composer-require-checker)[ Docs](https://github.com/maglnet/ComposerRequireChecker)[ RSS](/packages/maglnet-composer-require-checker/feed)WikiDiscussions 4.23.x Synced 1mo ago READMEChangelog (10)Dependencies (30)Versions (92)Used By (20) ComposerRequireChecker ====================== [](#composerrequirechecker) A CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package. This will prevent you from using "soft" dependencies that are not defined within your `composer.json` require section. [![current version](https://camo.githubusercontent.com/9d1244b0698c2e5562ef9a8ff192f92276af81c8ae0e6e9c6531f83d69104553/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6d61676c6e65742f636f6d706f7365722d726571756972652d636865636b65722e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/maglnet/composer-require-checker) What's it about? ---------------- [](#whats-it-about) "Soft" (or transitive) dependencies are code that you did not explicitly define to be there but use it nonetheless. The opposite is a "hard" (or direct) dependency. Your code most certainly uses external dependencies. Imagine that you found a library to access a remote API. You require `thatvendor/api-lib` for your software and use it in your code. This library is a hard dependency. Then you see that another remote API is available, but no library exists. The use case is simple, so you look around and find that `guzzlehttp/guzzle` (or any other HTTP client library) is already installed, and you use it right away to fetch some info. Guzzle just became a soft dependency. Then someday, when you update your dependencies, your access to the second API breaks. Why? Turns out that the reason `guzzlehttp/guzzle` was installed is that it is a dependency of `thatvendor/api-lib` you included, and their developers decided to update from an earlier major version to the latest and greatest, simply stating in their changelog: "Version 3.1.0 uses the latest major version of Guzzle - no breaking changes expected." And you think: What about my broken code? ComposerRequireChecker parses your code and your composer.json-file to see whether your code uses symbols that are not declared as a required library, i.e. that are soft dependencies. If you rely on components that are already installed but didn't explicitly request them, this tool will complain about them and you should require them explicitly, making them hard dependencies. This will prevent unexpected updates. In the situation above you wouldn't get the latest update of `thatvendor/api-lib`, but your code would continue to work if you also required `guzzlehttp/guzzle` before the update. The tool will also check for usage of PHP functions that are only available if an extension is installed, and will complain if that extension isn't explicitly required. Installation / Usage -------------------- [](#installation--usage) ComposerRequireChecker is not supposed to be installed as part of your project dependencies. ### PHAR file \[preferred\] [](#phar-file-preferred) Please check the [releases](https://github.com/maglnet/ComposerRequireChecker/releases) for available PHAR files. [Download the latest release](https://github.com/maglnet/ComposerRequireChecker/releases/latest/download/composer-require-checker.phar) and run it like this: ``` php composer-require-checker.phar check /path/to/your/project/composer.json ``` ### PHIVE [](#phive) If you already use [PHIVE](https://phar.io/) to install and manage your project’s tooling, then you should be able to simply install ComposerRequireChecker like this: ``` phive install composer-require-checker ``` ### Composer - global command [](#composer---global-command) This package can be easily globally installed by using [Composer](https://getcomposer.org): ``` composer global require maglnet/composer-require-checker ``` If you haven't already setup your composer installation to support global requirements, please refer to the [Composer CLI - global](https://getcomposer.org/doc/03-cli.md#global)If this is already done, run it like this: ``` composer-require-checker check composer.json ``` The `composer.json` here refers to the root Composer manifest of your project. ### A note about Xdebug [](#a-note-about-xdebug) If your PHP is including Xdebug when running ComposerRequireChecker, you may experience additional issues like exceeding the Xdebug-related max-nesting-level - and on top, Xdebug slows PHP down. It is recommended to run ComposerRequireChecker without Xdebug. If you cannot provide a PHP instance without Xdebug yourself, try setting an environment variable like this for just the command: `XDEBUG_MODE=off php composer-require-checker`. Configuration ------------- [](#configuration) ComposerRequireChecker is configured to whitelist some symbols per default. Have a look at the [config file example](data/config.dist.json) to see which configuration options are available. You can now adjust this file, as needed, and tell composer-require-checker to use it for its configuration. If you want to use the default whitelist, you may remove this section and only adjust the sections you would like to change. Note that if you want to add something on top of a section, you'll have to copy the whole section's content. This tool intentionally only reads one configuration file. If you pass only your new settings, you'll get error reports about the PHP core extensions and internal symbols like `true` or `false` being undefined. ``` bin/composer-require-checker check --config-file=path/to/config.json /path/to/your/project/composer.json ``` By default, it uses `composer-require-checker.json` if the file exists. ### Scan Additional Files [](#scan-additional-files) To scan files, that are not part of your autoload definition you may add glob patterns to the config file's `scan-files`section. The following example configuration file would also scan the file `bin/console` and all files with `.php` extension within your `bin/` folder: `composer-require-checker.json`: ``` { "scan-files" : ["bin/console", "bin/*.php"] } ``` If you don't like copying the tool's default settings, consider adding these paths to the Composer autoloading section of your project instead. Usage ----- [](#usage) ComposerRequireChecker runs on an existing directory structure. It does not change your code and does not even install your composer dependencies. That is a task that is entirely up to you, allowing you to change/improve things after a scan to see if it fixes the issue. So the usual workflow would be 1. Clone your repo 2. `composer install` your dependencies 3. `composer-require-checker check` your code ### Dealing with custom installer plugins [](#dealing-with-custom-installer-plugins) ComposerRequireChecker only fetches its knowledge of where files are from your project's `composer.json`. It does not use Composer itself to understand custom directory structures. If your project requires making use of any install plugins to put files in directories that are not `vendor/` or defined via the `vendor-dir` config setting in `composer.json`, ComposerRequireChecker will fail to detect the required code correctly. As a workaround, you can install your dependencies without plugins just for the scan: 1. Clone your repo 2. `composer install --no-plugins` will put all code into the `vendor` folder 3. `composer-require-checker check` your code 4. `composer install` dependencies once again in the correct location License ------- [](#license) This package is made available under the [MIT LICENSE](LICENSE). Credits ------- [](#credits) This package was initially designed by [Marco Pivetta](https://github.com/ocramius) and [Matthias Glaub](https://github.com/maglnet). And of course all [Contributors](https://github.com/maglnet/ComposerRequireChecker/graphs/contributors). ### Health Score 80 — ExcellentBetter than 100% of packages Maintenance87 Actively maintained with recent releases Popularity70 Solid adoption and visibility Community53 Growing community involvement Maturity96 Battle-tested with a long release history Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~45 days Recently: every ~1 days Total 85 Last Release 54d ago Major Versions 0.2.1 → 1.0.02018-07-11 1.1.0 → 2.0.02019-03-19 2.1.0 → 3.0.02021-01-18 3.8.x-dev → 4.0.02021-12-13 PHP version history (13 changes)0.1.0PHP ~7.0 0.2.0PHP ~7.1 2.0.0PHP ^7.1 2.1.0PHP ^7.2 3.0.0PHP ^7.4 || ^8.0 4.0.0PHP ^8.0 4.5.x-devPHP ~8.1.0 || ~8.2.0 4.7.0PHP ~8.1.0 || ~8.2.0 || ~8.3.0 4.8.x-devPHP ~8.2.0 || ~8.3.0 4.12.x-devPHP ~8.2.0 || ~8.3.0 || ~8.4.0 4.17.x-devPHP ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 4.19.x-devPHP ~8.3.0 || ~8.4.0 || ~8.5.0 4.21.x-devPHP ~8.4.0 || ~8.5.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/ed8ff51781adb3e444537560551a30438894fe5c3d427a8e0574ba1ed81088f5?d=identicon)[maglnet](/maintainers/maglnet) --- Top Contributors [![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4)](https://github.com/renovate[bot] "renovate[bot] (414 commits)")[![Ocramius](https://avatars.githubusercontent.com/u/154256?v=4)](https://github.com/Ocramius "Ocramius (317 commits)")[![maglnet](https://avatars.githubusercontent.com/u/4430279?v=4)](https://github.com/maglnet "maglnet (211 commits)")[![DanielBadura](https://avatars.githubusercontent.com/u/2017762?v=4)](https://github.com/DanielBadura "DanielBadura (65 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (45 commits)")[![MidnightDesign](https://avatars.githubusercontent.com/u/743172?v=4)](https://github.com/MidnightDesign "MidnightDesign (37 commits)")[![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4)](https://github.com/dependabot-preview[bot] "dependabot-preview[bot] (36 commits)")[![fredden](https://avatars.githubusercontent.com/u/334786?v=4)](https://github.com/fredden "fredden (31 commits)")[![localheinz](https://avatars.githubusercontent.com/u/605483?v=4)](https://github.com/localheinz "localheinz (20 commits)")[![dkreuer](https://avatars.githubusercontent.com/u/461576?v=4)](https://github.com/dkreuer "dkreuer (16 commits)")[![guillaume-perreal](https://avatars.githubusercontent.com/u/19730123?v=4)](https://github.com/guillaume-perreal "guillaume-perreal (8 commits)")[![SpacePossum](https://avatars.githubusercontent.com/u/10462973?v=4)](https://github.com/SpacePossum "SpacePossum (8 commits)")[![SvenRtbg](https://avatars.githubusercontent.com/u/416600?v=4)](https://github.com/SvenRtbg "SvenRtbg (7 commits)")[![fezfez](https://avatars.githubusercontent.com/u/1162307?v=4)](https://github.com/fezfez "fezfez (7 commits)")[![duncan3dc](https://avatars.githubusercontent.com/u/546811?v=4)](https://github.com/duncan3dc "duncan3dc (6 commits)")[![keradus](https://avatars.githubusercontent.com/u/2716794?v=4)](https://github.com/keradus "keradus (5 commits)")[![Jeroeny](https://avatars.githubusercontent.com/u/1517978?v=4)](https://github.com/Jeroeny "Jeroeny (5 commits)")[![VincentLanglet](https://avatars.githubusercontent.com/u/9052536?v=4)](https://github.com/VincentLanglet "VincentLanglet (5 commits)")[![xepozz](https://avatars.githubusercontent.com/u/6815714?v=4)](https://github.com/xepozz "xepozz (4 commits)")[![heiglandreas](https://avatars.githubusercontent.com/u/91998?v=4)](https://github.com/heiglandreas "heiglandreas (4 commits)") --- Tags ci-toolscode-qualitycomposerclistatic analysisdependencyrequirerequirementsimports ### Code Quality TestsPHPUnit Static AnalysisPHPStan, Psalm Type Coverage Yes ### Embed Badge ![Health badge](/badges/maglnet-composer-require-checker/health.svg) ``` [![Health](https://phpackages.com/badges/maglnet-composer-require-checker/health.svg)](https://phpackages.com/packages/maglnet-composer-require-checker) ``` ### Alternatives [vimeo/psalm A static analysis tool for finding errors in PHP applications 5.8k77.5M6.7k](/packages/vimeo-psalm)[behat/behat Scenario-oriented BDD framework for PHP 4.0k96.8M2.0k](/packages/behat-behat)[infection/infection Infection is a Mutation Testing framework for PHP. The mutation adequacy score can be used to measure the effectiveness of a test set in terms of its ability to detect faults. 2.2k26.2M1.8k](/packages/infection-infection)[phan/phan A static analyzer for PHP 5.6k11.2M1.1k](/packages/phan-phan)[icanhazstring/composer-unused Show unused packages by scanning your code 1.7k7.0M188](/packages/icanhazstring-composer-unused)[overtrue/phplint `phplint` is a tool that can speed up linting of php files by running several lint processes at once. 1.0k13.2M726](/packages/overtrue-phplint) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)