Skip to content

Conversation

@mairo744
Copy link

Q A
Documentation no
Bugfix no
BC Break no
New Feature no
RFC no
QA yes

Description

This PR introduces shipmonk/composer-dependency-analyser to improve dependency management.

  • To detect dead/misplaced/shadow dependencies
  • To enforce stricter dependency hygiene in CI, preventing similar issues in the future.
  • remove obsolete zend dependencies

@gsteel
Copy link
Member

gsteel commented Oct 13, 2025

If I'm honest - I do prefer composer-require-checker to find only undeclared symbols. It's not unusual for us to have seemingly "unused" deps in our libs and these will normally be identified manually.

Also, I prefer the approach of adding deps in a /tools directory with along with a companion Makefile such as that found in https://github.com/laminas/laminas-view/tree/3.0.x - this prevents tooling from causing dependency conflicts which happens more than you might think.

Comment on lines -38 to -43
// Legacy Zend Framework aliases
'aliases' => [
LegacyProblemDetailsMiddleware::class => ProblemDetailsMiddleware::class,
LegacyProblemDetailsNotFoundHandler::class => ProblemDetailsNotFoundHandler::class,
LegacyProblemDetailsResponseFactory::class => ProblemDetailsResponseFactory::class,
],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These aliases cannot be dropped in a minor - that's a BC break. They can be stringified to prevent issues though.

Comment on lines -71 to +70
return $deprecatedResponseFactory !== null && $deprecatedResponseFactory !== ResponseFactoryFactory::class;
return $deprecatedResponseFactory !== null;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is in place for BC with callable response factories - it can't be removed in a minor

@Xerkus
Copy link
Member

Xerkus commented Oct 13, 2025

@mairo744
Copy link
Author

Thanks for the valuable feedback. I’ll close this PR for now. It’s better to start from the default branch with the composer require checker.

@mairo744 mairo744 closed this Oct 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants