Composer-Unused
A Composer tool that scans your PHP code to identify and show unused Composer dependencies.
What is Composer-Unused?
composer-unused is a static analysis tool for PHP projects that identifies Composer dependencies installed but not actually used in the codebase. It scans code to detect which package symbols are referenced, helping developers maintain cleaner projects by removing unnecessary packages. This solves the problem of accumulating unused dependencies in large repositories, reducing maintenance overhead.
PHP developers working on medium to large projects with many Composer dependencies, particularly those using frameworks like Symfony where dependency bloat can accumulate. It's also valuable for teams focused on code hygiene and performance optimization.
Developers choose composer-unused because it provides accurate, actionable insights through static analysis of symbol usage, unlike basic tools that only show dependency chains. Its unique selling points include framework-specific configuration sets (e.g., for Symfony), performance optimizations like automatic XDebug disabling, and flexible filtering options for excluding directories or packages.
Overview
Show unused composer dependencies by scanning your code
Use Cases
Best For
- Identifying and removing unused Composer packages in large PHP repositories to reduce bloat.
- Optimizing Symfony projects with predefined configuration sets that automatically scan framework-specific directories.
- Enforcing code hygiene in CI/CD pipelines by integrating dependency usage checks.
- Analyzing projects with incomplete autoload definitions by specifying additional files to parse per dependency.
- Excluding specific directories or packages from analysis using named or pattern-based filters for customized scans.
- Improving performance in development environments by automatically disabling XDebug during execution to avoid overhead.
Not Ideal For
- Projects with heavy reliance on dynamic code loading or reflection, where static analysis may produce inaccurate results.
- Teams needing immediate, zero-configuration analysis for non-standard project structures without predefined framework sets.
- Environments where XDebug must remain enabled during tool execution for debugging purposes, as it's disabled by default.
Pros & Cons
Pros
Scans actual code to identify which Composer package symbols are referenced, providing accurate insights beyond simple dependency chains.
Includes predefined configuration sets for Symfony, automatically scanning framework-specific directories like config/ and migrations/.
Automatically disables XDebug during execution to improve speed and memory usage, with an option to re-enable via environment variable.
Supports excluding directories and packages using command-line options or configuration files, with pattern-based filtering for scalability.
Cons
Local Composer installation is discouraged due to version conflicts, forcing users to manage PHAR files or use PHIVE, adding setup steps.
May miss dependencies used dynamically, such as through string class names or runtime evaluations, unless manually configured with additional files.
Only provides a predefined configuration set for Symfony, requiring custom implementation for other frameworks or complex project setups.
Frequently Asked Questions
Related Projects
OctoLinker Browser ExtensionOctoLinker — Links together, what belongs together
SatisSimple static Composer repository generator - For a full private Composer repo use Private Packagist
Composer/Xdebug-HandlerRestart a CLI process without loading the xdebug extension.
Composer-PatchesSimple patches plugin for Composer
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.