From e0e8a51bde2becb843a575d484faf264a2d89aba Mon Sep 17 00:00:00 2001
From: Sergei Predvoditelev <sergei@predvoditelev.ru>
Date: Sat, 8 Aug 2026 08:20:24 +0300
Subject: [PATCH] Add Composer Dependency Analyser

---
 .../composer-dependency-analyser.yml          | 27 +++++++++++++++++
 .../workflows/composer-require-checker.yml    | 30 -------------------
 composer-dependency-analyser.php              | 16 ++++++++++
 composer-require-checker.json                 |  6 ----
 composer.json                                 |  4 +--
 docs/internals.md                             |  6 ++--
 6 files changed, 48 insertions(+), 41 deletions(-)
 create mode 100644 .github/workflows/composer-dependency-analyser.yml
 delete mode 100644 .github/workflows/composer-require-checker.yml
 create mode 100644 composer-dependency-analyser.php
 delete mode 100644 composer-require-checker.json

diff --git a/.github/workflows/composer-dependency-analyser.yml b/.github/workflows/composer-dependency-analyser.yml
new file mode 100644
index 000000000..3fed6a399
--- /dev/null
+++ b/.github/workflows/composer-dependency-analyser.yml
@@ -0,0 +1,27 @@
+name: composer dependency analyser
+
+on:
+  pull_request:
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
+      - 'composer.json'
+      - 'composer-dependency-analyser.php'
+  push:
+    branches: ['master']
+    paths: *paths
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
+    with:
+      php: >-
+        ['8.1', '8.2', '8.3', '8.4', '8.5']
diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
deleted file mode 100644
index 3dccb976d..000000000
--- a/.github/workflows/composer-require-checker.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Composer require checker
-
-permissions:
-  contents: read
-
-on:
-  pull_request: &ignore-paths
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'psalm.xml'
-
-  push:
-    <<: *ignore-paths
-    branches: ['master']
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  composer-require-checker:
-    uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
-    with:
-      php: >-
-        ['8.1', '8.2', '8.3', '8.4', '8.5']
diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php
new file mode 100644
index 000000000..98eab3bae
--- /dev/null
+++ b/composer-dependency-analyser.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true)
+    ->ignoreUnknownClasses([
+        // Optional dependencies, see "suggest" in composer.json.
+        'Yiisoft\Assets\AssetBundle',
+        'Yiisoft\Files\PathMatcher\PathMatcher',
+    ]);
diff --git a/composer-require-checker.json b/composer-require-checker.json
deleted file mode 100644
index d46b81c52..000000000
--- a/composer-require-checker.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-    "symbol-whitelist": [
-        "Yiisoft\\Assets\\AssetBundle",
-        "Yiisoft\\Files\\PathMatcher\\PathMatcher"
-    ]
-}
diff --git a/composer.json b/composer.json
index 83ba25705..1c7151459 100644
--- a/composer.json
+++ b/composer.json
@@ -22,10 +22,10 @@
     },
     "require-dev": {
         "friendsofphp/php-cs-fixer": "^3.92.5",
-        "maglnet/composer-require-checker": "^4.1",
         "phpunit/phpunit": "^10.5",
         "rector/rector": "^2.0",
         "roave/infection-static-analysis-plugin": "^1.35",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^5.26.1|^6.4.1",
         "yiisoft/aliases": "^3.0",
@@ -61,7 +61,7 @@
         }
     ],
     "scripts": {
-        "check-dependencies": "./vendor/bin/composer-require-checker check",
+        "dependency-analyser": "composer-dependency-analyser",
         "mutation": "vendor/bin/roave-infection-static-analysis-plugin --threads=2 --min-msi=100 --min-covered-msi=100 --ignore-msi-with-no-mutations --only-covered",
         "static": "vendor/bin/psalm",
         "test": "phpunit --testdox",
diff --git a/docs/internals.md b/docs/internals.md
index 087a514ac..b77907c0c 100644
--- a/docs/internals.md
+++ b/docs/internals.md
@@ -36,9 +36,9 @@ use either newest or any specific version of PHP:
 
 ## Dependencies
 
-This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if
-all dependencies are correctly defined in `composer.json`. To run the checker, execute the following command:
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
 
 ```shell
-./vendor/bin/composer-require-checker
+./vendor/bin/composer-dependency-analyser
 ```