From 60c27d887ac4a6a201e007196b45ef5777e21c9d Mon Sep 17 00:00:00 2001
From: Sergei Predvoditelev <sergei@predvoditelev.ru>
Date: Sat, 8 Aug 2026 08:21:09 +0300
Subject: [PATCH 1/3] Add Composer Dependency Analyser

---
 ...e-checker.yml => composer-dependency-analyser.yml} | 11 +++++------
 composer-dependency-analyser.php                      | 11 +++++++++++
 composer.json                                         |  3 ++-
 docs/internals.md                                     |  9 +++++++++
 4 files changed, 27 insertions(+), 7 deletions(-)
 rename .github/workflows/{composer-require-checker.yml => composer-dependency-analyser.yml} (58%)
 create mode 100644 composer-dependency-analyser.php

diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-dependency-analyser.yml
similarity index 58%
rename from .github/workflows/composer-require-checker.yml
rename to .github/workflows/composer-dependency-analyser.yml
index 99dfb1c..e6ee15a 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-dependency-analyser.yml
@@ -1,12 +1,13 @@
-name: Composer require checker
+name: composer dependency analyser
 
 on:
   pull_request:
     paths: &paths
       - 'src/**'
       - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
       - 'composer.json'
-      - '.github/workflows/composer-require-checker.yml'
+      - 'composer-dependency-analyser.php'
   push:
     branches: ['master']
     paths: *paths
@@ -19,10 +20,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  composer-require-checker:
-    uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
     with:
-      os: >-
-        ['ubuntu-latest']
       php: >-
         ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php
new file mode 100644
index 0000000..5b4c026
--- /dev/null
+++ b/composer-dependency-analyser.php
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true);
diff --git a/composer.json b/composer.json
index 22193de..1664942 100644
--- a/composer.json
+++ b/composer.json
@@ -34,9 +34,9 @@
     "require-dev": {
         "bamarni/composer-bin-plugin": "^1.8.3",
         "friendsofphp/php-cs-fixer": "^3.95",
-        "maglnet/composer-require-checker": "^3.8 || ^4.4",
         "phpunit/phpunit": "^9.6.22",
         "rector/rector": "^2.0.10",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "spatie/phpunit-watcher": "^1.23.6",
         "yiisoft/code-style": "^1.1"
     },
@@ -52,6 +52,7 @@
     },
     "scripts": {
         "cs-fix": "php-cs-fixer fix",
+        "dependency-analyser": "composer-dependency-analyser",
         "rector": "rector",
         "test": "phpunit --testdox --no-interaction",
         "test-watch": "phpunit-watcher watch"
diff --git a/docs/internals.md b/docs/internals.md
index b37b5b8..9a72f59 100644
--- a/docs/internals.md
+++ b/docs/internals.md
@@ -24,3 +24,12 @@ The code is statically analyzed with [Psalm](https://psalm.dev/). To run static
 ```shell
 ./vendor/bin/psalm
 ```
+
+## Dependencies
+
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
+
+```shell
+./vendor/bin/composer-dependency-analyser
+```

From b82cd6faab90c377730151a3bb499d733694c4ab Mon Sep 17 00:00:00 2001
From: Sergei Predvoditelev <sergei@predvoditelev.ru>
Date: Sun, 9 Aug 2026 17:32:52 +0300
Subject: [PATCH 2/3] Apply suggestion from @vjik

---
 composer-dependency-analyser.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php
index 5b4c026..88be730 100644
--- a/composer-dependency-analyser.php
+++ b/composer-dependency-analyser.php
@@ -7,5 +7,5 @@
 return (new Configuration())
     ->disableComposerAutoloadPathScan()
     ->setFileExtensions(['php'])
-    ->addPathToScan(__DIR__ . '/src', isDev: false)
-    ->addPathToScan(__DIR__ . '/tests', isDev: true);
+    ->addPathToScan(__DIR__ . '/src', false)
+    ->addPathToScan(__DIR__ . '/tests', true);

From 716811ecce144dec4dcfe7bdb667eb18654cac41 Mon Sep 17 00:00:00 2001
From: Sergei Predvoditelev <sergei@predvoditelev.ru>
Date: Sun, 9 Aug 2026 17:37:38 +0300
Subject: [PATCH 3/3] fix

---
 tools/psalm/composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/psalm/composer.json b/tools/psalm/composer.json
index 4b37abf..e24405f 100644
--- a/tools/psalm/composer.json
+++ b/tools/psalm/composer.json
@@ -1,5 +1,5 @@
 {
     "require-dev": {
-        "vimeo/psalm": "^4.30 || ^5.26.1 || ^6.8.8"
+        "vimeo/psalm": "^4.30 || ^5.26.1 || ^6.16.1"
     }
 }