ComposerRequireChecker CLI
ComposerRequireChecker finds PHP symbols and extensions used by code but missing from its declared direct Composer dependencies.
- 1,011 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The scan reads local project sources and its installed dependency tree.
Install
Manual install
Use the first recommended PHAR option and verify its origin. Scan a prepared dependency tree and agree on fixes separately.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The scan reads local project sources and its installed dependency tree.
This is third-party code. Review the repository files before installing.
What it does
ComposerRequireChecker parses PHP sources and compares used symbols with `composer.json` dependencies. It detects reliance on libraries installed only transitively, helping make requirements explicit before package updates. It also checks extension-provided functions and can scan additional files outside normal autoload paths. The tool reads an existing directory structure; it does not install dependencies or edit code. Developers decide which requirements or approved exceptions to change after reviewing the report.
Who it is for. PHP package maintainers checking undeclared library and extension dependencies before a release.
Good fit when
- Review direct dependencies after a library update.
- Declare PHP extensions used by a package.
- Find unknown symbols in CI before a release.
- Include scripts outside autoloading in a static scan.
Not a fit when
- The tool must install packages or edit `composer.json` itself.
- You need complete runtime testing rather than dependency analysis.
- Custom installer-plugin directory layouts have not been accounted for.
Example request
Check composer.json and PHP sources for undeclared dependencies, explain findings and propose edits without installing packages.Limitations
The scan needs an existing dependency tree prepared separately with Composer. Custom installer plugins may place code outside expected directories, preventing correct symbol discovery. Only one configuration file is read, so extending allowlists requires preserving needed default values. Xdebug can slow analysis and cause nesting-limit errors; prepare an appropriate PHP process without it when running the check.
How to disable. Remove the CI check and delete its standalone PHAR if no longer needed. The tool does not modify project sources.
FAQ
Does it change code?
No. It reads the project and reports dependencies; apply fixes separately.
Should it be a project dependency?
No. Download the standalone PHAR from Releases and run it against the intended project. Prepare that project’s dependencies beforehand.
Are PHP extensions checked?
Yes. Required extension functions should have corresponding Composer requirements.
How do I include scripts outside autoloading?
Add glob patterns under configuration `scan-files` and review scan coverage.
Why did configuration trigger core-symbol errors?
The replacement configuration may have lost default allowlist entries. Compare the full list with the project example.
Discussion
No questions or reviews yet.
Related
CLI toolsPHP_CodeSniffer is a PHP checking CLI that applies project rules locally and in CI so teams share one coding standard.
An adversarial code-audit skill: Hunter finds bugs, Skeptic challenges them, Referee rules, and no source edit happens without your permission
A Claude Code plugin that verifies a change against its plan: boots your stack, runs acceptance criteria, reports evidence.
Qlty CLI reports duplicate and complex code before refactoring; automatic formatting runs as a separate action.
A CLI for testing and red teaming LLM applications: compares models, runs automated CI checks and finds vulnerabilities
A Claude Code and OpenCode plugin that will not let a session end until 1C edits pass standards, architecture and XML checks
README in short
Custom configuration defaults to `composer-require-checker.json`. Documentation covers nonstandard dependency layouts.