composer-unused / composer-unused

Show unused composer dependencies by scanning your code

composer-unused

A Composer tool to show unused Composer dependencies by scanning your code.

Created by Andreas Frömer and contributors, logo by Caneco.

⚠️ If you want to use this tool as composer-plugin head over to composer-unused-plugin.

Motivation

When working in a big repository, you sometimes lose track of your required Composer packages. There may be so many packages you can't be sure if they are actually used or not.

Unfortunately, the composer why command only gives you the information about why a package is installed in dependency to another package.

How do we check whether the provided symbols of a package are used in our code?

composer unused to the rescue!

Installation

⚠️ This tool heavily depends on certain versions of its dependencies. A local installation of this tool is not recommended as it might not work as intended or can't be installed correctly. We do recommened you download the .phar archive or use PHIVE to install it locally.

PHAR (PHP Archive) (recommended)

Install via phive or grab the latest composer-unused.phar from the latest release:

phive install composer-unused
curl -OL https://github.com/composer-unused/composer-unused/releases/latest/download/composer-unused.phar

Local

You can also install composer-unused as a local development dependency:

composer require --dev icanhazstring/composer-unused

Usage

Depending on the kind of your installation the command might differ.

Note: Packages must be installed via composer install or composer update prior to running composer-unused.

PHAR

The phar archive can be run directly in you project:

php composer-unused.phar

Local

Having composer-unused as a local dependency you can run it using the shipped binary:

vendor/bin/composer-unused

Exclude folders and packages

Sometimes you don't want to scan a certain directory or ignore a Composer package while scanning. In these cases, you can provide the --excludeDir or the --excludePackage option. These options accept multiple values as shown next:

php composer-unused.phar --excludeDir=config --excludePackage=symfony/console
php composer-unused.phar \
    --excludeDir=bin \
    --excludeDir=config \
    --excludePackage=symfony/assets \
    --excludePackage=symfony/console

Make sure the package is named exactly as in your composer.json

Configuration

You can configure composer-unused by placing a composer-unused.php beside the projects composer.json This configuration can look something like this: composer-unused.php

Ignore dependencies by name

To ignore dependencies by their name, add the following line to your configuration:

$config->addNamedFilter(NamedFilter::fromString('dependency/name'));

Ignore dependencies by pattern

To ignore dependencies by pattern, add the following line to your configuration

$config->addPatternFilter(PatternFilter::fromString('/dependency\/name/'));

You can ignore multiple dependencies by a single organization using PatternFilter e.g. /symfony\/.*/

Additional files to be parsed

Per default, composer-unused is using the composer.json autoload directive to determine where to look for files to parse. Sometimes dependencies don't have their composer.json correctly set up, or files get loaded in another way. Using this, you can define additional files on a per-dependency basis.

$config->setAdditionalFilesFor('dependency/name', [<list-of-file-paths>]);

Changelog

Please have a look at CHANGELOG.md.

Contributing

Please have a look at CONTRIBUTING.md.

Code of Conduct

Please have a look at CODE_OF_CONDUCT.md.

License

This package is licensed under the MIT License.

composer-unused's Issues

Feature: Add option to suppress progressbar

Is your feature request related to a problem? Please describe

When using composer-unused in CI environment, the progressbar often screws up the logs.

0/814 [░░░░░░░░░░░░░░░░░░░░░░░░░░░░]   0%
82/814 [▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░]  10%
245/814 [▓▓▓▓▓▓▓▓░░░░░░░░░░░░░░░░░░░░]  30%
326/814 [▓▓▓▓▓▓▓▓▓▓▓░░░░░░░░░░░░░░░░░]  40%
407/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░░░░░░░░░]  50%
489/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░░░░░░░]  60%
570/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░░░░]  70%
652/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░]  80%
733/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░]  90%
814/814 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%

Describe the solution you'd like

Add a cli option--no-progress to suppress the progressbar.

Feature: Interactive remove of unused packages

After listing the unused packages, there should be an interactive mode to remove unused packages.

Describe the solution you'd like
After finding unused packages the user should get asked what to do with unused packages:

• remove
• skip
• ignore (should be added to composer.json extra for ignore)

Additional information
This kind of behavior should be optional and might be enabled with a cli parameter --interactive. Using an opt-in parameter this should not interfere with CI usage of this tool.

Call to undefined method: "isFullyQualified()"

php7.2 /usr/bin/composer global require icanhazstring/composer-unused

Using version ^0.1.0 for icanhazstring/composer-unused
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 2 installs, 0 updates, 0 removals
  - Installing nikic/php-parser (v4.2.1): Loading from cache
  - Installing icanhazstring/composer-unused (0.1.0): Downloading (100%) 

php7.2 /usr/bin/composer unused

PHP Fatal error:  Uncaught Error: Call to undefined method PhpParser\Node\Expr\Variable::isFullyQualified() in /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/Strategy/StaticParseStrategy.php:25
Stack trace:
#0 /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/NodeVisitor.php(34): Icanhazstring\Composer\Unused\Parser\Strategy\StaticParseStrategy->meetsCriteria(Object(PhpParser\Node\Stmt\Expression))
#1 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(200): Icanhazstring\Composer\Unused\Parser\NodeVisitor->enterNode(Object(PhpParser\Node\Stmt\Expression))
#2 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(114): PhpParser\NodeTraverser->traverseArray(Array)
#3 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(223): PhpParser\NodeTraverser->traverseNode(Object(PhpParser\Node\Stmt\Foreach_))
#4 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(114 in /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/Strategy/StaticParseStrategy.php on line 25

Fatal error: Uncaught Error: Call to undefined method PhpParser\Node\Expr\Variable::isFullyQualified() in /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/Strategy/StaticParseStrategy.php:25
Stack trace:
#0 /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/NodeVisitor.php(34): Icanhazstring\Composer\Unused\Parser\Strategy\StaticParseStrategy->meetsCriteria(Object(PhpParser\Node\Stmt\Expression))
#1 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(200): Icanhazstring\Composer\Unused\Parser\NodeVisitor->enterNode(Object(PhpParser\Node\Stmt\Expression))
#2 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(114): PhpParser\NodeTraverser->traverseArray(Array)
#3 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(223): PhpParser\NodeTraverser->traverseNode(Object(PhpParser\Node\Stmt\Foreach_))
#4 /home/lmoelleken/.composer/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(114 in /home/lmoelleken/.composer/vendor/icanhazstring/composer-unused/src/Parser/Strategy/StaticParseStrategy.php on line 25

Feature: Add gpg signature for phive deployment

Since #64 composer-unused is able to be delivered through a phar file.
Need to add a gpg signature for downloadability through phive.

myclabs/php-enum is marked as unused

https://github.com/myclabs/php-enum

Reproduced here https://github.com/simPod/php-bugs/tree/unused-enum

<?php

declare(strict_types=1);

namespace SimPod\Bugs;

/**
 * @template T
 * @extends \MyCLabs\Enum\Enum<T>
 * @psalm-immutable
 */
abstract class Enum extends \MyCLabs\Enum\Enum
{
}

[Question] Would you write your own usage parser?

This question is directed to issue #43. Some frameworks (e.g. symfony) are using other file types (xml, yml) to link used packages to the system. As of now composer-unused is only able to scan for usages using php-parser, which in return, only supports php files.

Would it be useful to provide a certain "plugin" feature, so people could write their own usage parser? (similar to phpstan extensions)

So for example there could be a composer-unused/symfony-extension which scans the used services from framework specific configs.

Of course there will be existing parsers for most common frameworks like symfony, laravel and sorts (if the config is not in php). Everything else will be up to you.

Please leave comment what you think about, or simply respond with the proper reaction :)

Thanks a lot!

ServiceManager (Zend) not found in container.php (0.6.0)

Describe the bug
I wanted to install the dependency with composer require --dev icanhazstring/composer-unused and afterwards I got the error message that the Zend\ServiceManager\ServiceManager was not found. The Dependency was removed with the 0.6.0 release and can therefore no longer be resolved.

Error dump

PHP Fatal error:  Uncaught Error: Class 'Zend\ServiceManager\ServiceManager' not found in C:\[project]\vendor\icanhazstring\composer-unused\config\container.php:5
Stack trace:
#0 C:\[project]\vendor\icanhazstring\composer-unused\src\UnusedPlugin.php(34): require()
#1 phar://C:/Users/xyz/AppData/Local/ComposerSetup/bin/composer.phar/src/Composer/Plugin/PluginManager.php(236): Icanhazstring\Composer\Unused\UnusedPlugin->activate(Object(Composer\Composer), Object(Composer\IO\ConsoleIO))
#2 phar://C:/Users/xyz/AppData/Local/ComposerSetup/bin/composer.phar/src/Composer/Plugin/PluginManager.php(205): Composer\Plugin\PluginManager->addPlugin(Object(Icanhazstring\Composer\Unused\UnusedPlugin))
#3 phar://C:/Users/xyz/AppData/Local/ComposerSetup/bin/composer.phar/src/Composer/Installer/PluginInstaller.php(62): Composer\Plugin\PluginManager->registerPackage(Object(Composer\Package\CompletePackage), true)
#4 phar://C:/Users/xyz/AppData/Local/ComposerSetup/bin/composer.phar/src/Comp in C:\[project]\vendor\icanhazstring\composer-unused\config\container.php on line 5

Support packages only used in composer "scripts" section

Is your feature request related to a problem? Please describe.
Some packages may only be used in the scripts section of the composer.json file. These are shown as unused. An example would be incenteev/composer-parameter-handler.

Usage:

{
    "require": {
        "incenteev/composer-parameter-handler": "~2.0"
    },
    "scripts": {
        "my-custom-scripts": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
            "// ..."
        ],
        "post-install-cmd": [
            "@my-custom-scripts"
        ],
        "post-update-cmd": [
            "@my-custom-scripts"
        ]
    },
    "// skipped the configuration of the package"
}

Describe the solution you'd like
The package shouldn't be shown as unused.

Maintenance: Replace debug logging with psr/log

Is your feature request related to a problem? Please describe.
Currently there is a "self-build" debug logger to catch identify problems when running in debug mode. This should be replaced with a simple psr/log implementation (maybe monolog)

Describe the solution you'd like
Currently the log has a structure inside, which makes it hard to see what happend first. This should be replaced with a simple "start to end" log like a typical application log.

For this the method debug, error and info should come in handy.

False positive for ramsey/uuid-doctrine and beberlei/doctrineextensions

Describe the bug

The https://github.com/ramsey/uuid-doctrine and https://github.com/beberlei/doctrineextensions is reported as unused in my symfony project.

But I do used them. This way

doctrine:
    dbal:
        types:
            uuid: Ramsey\Uuid\Doctrine\UuidType
    orm:
        dql:
            datetime_functions:
                DATEDIFF: DoctrineExtensions\Query\Mysql\DateDiff
                DATE_FORMAT: DoctrineExtensions\Query\Mysql\DateFormat
                MONTH: DoctrineExtensions\Query\Mysql\Month
                NOW: DoctrineExtensions\Query\Mysql\Now
                SEC_TO_TIME: DoctrineExtensions\Query\Mysql\SecToTime
                TIMEDIFF: DoctrineExtensions\Query\Mysql\TimeDiff
                TIME_TO_SEC: DoctrineExtensions\Query\Mysql\TimeToSec
                WEEK: DoctrineExtensions\Query\Mysql\Week
                YEAR: DoctrineExtensions\Query\Mysql\Year
                YEARWEEK: DoctrineExtensions\Query\Mysql\YearWeek
            numeric_functions:
                FLOOR: DoctrineExtensions\Query\Mysql\Floor
                NULLIF: DoctrineExtensions\Query\Mysql\NullIf
            string_functions:
                SOUNDEX: DoctrineExtensions\Query\Mysql\Soundex

Can this project handle yaml config ?

Error while running on sylius

Describe the bug

Running composer unused on sylius results in the following error:

Fatal error: Interface 'PhpParser\ErrorHandler' not found in /Users/myuser/.composer/vendor/icanhazstring/composer-unused/src/Error/ErrorHandlerInterface.php on line 10

Steps to reproduce:

• composer create-project sylius/sylius-standard acme
• cd acme
• composer unused

Error dump

root@612131282c98:/acme# composer unused -vvv
Reading ./composer.json
Loading config file ./composer.json
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/acme): git branch --no-color --no-abbrev -v
Executing command (/acme): git describe --exact-match --tags
Executing command (/acme): git log --pretty="%H" -n1 HEAD
Executing command (/acme): hg branch
Executing command (/acme): fossil branch list
Executing command (/acme): fossil tag list
Executing command (/acme): svn info --xml
Reading /root/.composer/composer.json
Loading config file /root/.composer/composer.json
Reading /acme/vendor/composer/installed.json
Reading /root/.composer/vendor/composer/installed.json
Loading plugin Symfony\Thanks\Thanks
Loading plugin Symfony\Flex\Flex
Loading plugin PHPStan\ExtensionInstaller\Plugin
Loading plugin PackageVersions\Installer
Loading plugin Icanhazstring\Composer\Unused\UnusedPlugin
Loading plugin Hirak\Prestissimo\Plugin
PHP Fatal error:  Interface 'PhpParser\ErrorHandler' not found in /root/.composer/vendor/icanhazstring/composer-unused/src/Error/ErrorHandlerInterface.php on line 10

Fatal error: Interface 'PhpParser\ErrorHandler' not found in /root/.composer/vendor/icanhazstring/composer-unused/src/Error/ErrorHandlerInterface.php on line 10

Additional information

• php 7.3

Feature: Add a manual to install the package locally

Is your feature request related to a problem? Please describe.

Saying local I mean installed through the project package.json file. Many people prefer local installation to global in order to:

• Not clog the system
• Have an ability to have different package versions for different projects
• Make their projects be installed using a single composer install command

Describe the solution you'd like

Add an instruction about how to install and use the «unused» package locally.

A common scenario is:

1. Install a package as a development dependency:

   composer require --dev icanhazstring/composer-unused

2. Add a script for it into the composer.json file:

   {
       // ...
       "scripts": {
           "find-unused": "./vendor/bin/unused"
       }
   }

3. Run the composer script:

   composer run find-unused

Warning, this is a suggested manual and it may not work, I haven't checked it.

Fix spelling of 'used' in README.md and src/Command/UnusedCommand.php

Describe the bug
Thanks for a really neat tool! As I was generating reports, I noticed that
used is spelled 'usued' in README.md and UnusedCommand.php

ross@ubuntu1804:~/project/composer-unused $ ag usued .
README.md
61:Found 13 usued and 0 unused packages

src/Command/UnusedCommand.php
97:                'Found <fg=green>%d usued</> and <fg=red>%d unused</> packages',

php is always marked as unused requirement

Describe the bug

A composer.json with a php version constraint gets as output that the php requirement is unused and should be discarded. There is a psr 4 valid class in the src folder that uses a core function. That should count to require any php version.

Error dump

composer.json

{
    "name": "foo/bar",
    "description": "foobar",
    "type": "library",
    "minimum-stability": "stable",
    "require": {
        "php": ">=7.4 <7.5"
    },
    "autoload": {
        "psr-4": {
            "Foo\\Bar\\": "src/"
        }
    },
    "require-dev": {
        "phpunit/phpunit": ">=9.1 <10",
        "phpstan/phpstan": ">=0.12 <0.13",
        "phpstan/extension-installer": ">=1 <2",
        "phpstan/phpstan-phpunit": ">=0.12 <0.13",
        "phpstan/phpstan-deprecation-rules": ">=0.12 <0.13",
        "phpstan/phpstan-strict-rules": ">=0.12 <0.13",
        "psalm/plugin-phpunit": ">=0.10 <0.11",
        "vimeo/psalm": ">=3 <4",
        "infection/infection": ">=0.15 <0.16",
        "friendsofphp/php-cs-fixer": ">=2 <3",
        "icanhazstring/composer-unused": ">=0.7 <0.8"
    },
    "autoload-dev": {
        "psr-4": {
            "Foo\\Bar\\Test\\": "test/"
        }
    }
}

Command

composer unused -vvv

Plugin command unused (Icanhazstring\Composer\Unused\Command\UnusedCommand) would override a Composer command and has been skipped
Running 1.10.6 (2020-05-06 10:28:10) with PHP 7.4.6 on Darwin / 19.3.0
You are running composer with Xdebug enabled. This has a major impact on runtime performance. See https://getcomposer.org/xdebug

Loading packages
----------------

 1/1 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100% < 1 sec/< 1 sec 12.0 MiB

Scanning files from basedir /Users/joshuabehrens/tmp/foo-bar-base
--------------------------------------------------------------------------------

 2/2 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100% < 1 sec/< 1 sec 14.0 MiB

Results
-------

Found 0 used, 1 unused and 0 ignored packages

 Used packages

 Unused packages
 ✗ php

 Ignored packages                                                                                                                                                                                                         

Log

{"time":"2020-05-16T15:24:01.074944+00:00","level":"info","message":"version","context":{"value":"0.7.0"}}
{"time":"2020-05-16T15:24:01.075084+00:00","level":"info","message":"requires","context":{"php":">=7.4 <7.5"}}
{"time":"2020-05-16T15:24:01.075108+00:00","level":"info","message":"dev-requires","context":{"phpunit\/phpunit":">=9.1 <10","phpstan\/phpstan":">=0.12 <0.13","phpstan\/extension-installer":">=1 <2","phpstan\/phpstan-phpunit":">=0.12 <0.13","phpstan\/phpstan-deprecation-rules":">=0.12 <0.13","phpstan\/phpstan-strict-rules":">=0.12 <0.13","psalm\/plugin-phpunit":">=0.10 <0.11","vimeo\/psalm":">=3 <4","infection\/infection":">=0.15 <0.16","friendsofphp\/php-cs-fixer":">=2 <3","icanhazstring\/composer-unused":">=0.7 <0.8"}}
{"time":"2020-05-16T15:24:01.075122+00:00","level":"info","message":"autoload","context":{"psr-4":{"Foo\\Bar\\":"src\/"}}}
{"time":"2020-05-16T15:24:01.075132+00:00","level":"info","message":"dev-autoload","context":{"psr-4":{"Foo\\Bar\\Test\\":"test\/"}}}
{"time":"2020-05-16T15:24:01.158628+00:00","level":"debug","message":"Parsing file \/Users\/joshuabehrens\/tmp\/foo-bar-base\/dev-ops\/php_cs.php","context":[]}
{"time":"2020-05-16T15:24:01.168590+00:00","level":"debug","message":"Parsing file \/Users\/joshuabehrens\/tmp\/foo-bar-base\/src\/Party.php","context":[]}

Feature: Check for used packages from autoload-dev

To ensure a proper production release ready build, dev requirements should not be included.

So ensure that no source code from dev requirements or the dev requirement tree is used without it to require as root requirement a new check should be implemented.

Composer 2 support

Is your feature request related to a problem? Please describe

Composer is starting to roll out 2.0-dev builds: composer/composer#8726

Describe the solution you'd like

Support Composer 2.0 (without BC if possible), without dropping 1.0 support.

Describe alternatives you've considered

If the above is not possible, we can plan a new major version.

Feature: Ignore packages that are no library

Is your feature request related to a problem? Please describe.
As there are different types of package "types" of composer packages. We need to only scan those that are a library or a project. Everything else might not have a provided namespace.

As seen in #15 (foxy/foxy)

Describe the solution you'd like
Only scan packages that are proper source packages (project, library).
Everything else can be listed as "ignored" (with package type).

---

Edit: As per definition. The composer.json schema states exactly 4 types of composer packages.
https://getcomposer.org/doc/04-schema.md#type

• library
• project
• metapackage
• composer-plugin

composer unused should focus on the library aspect of packages. These are the packages that provide a namespace as well as classes that are used.

However, the other packages should be listet as ignored since they don't provide any information if they are used or not.

PHAR file

I just want to ask if there are any plans on distributing a PHAR file for future releases. I think this tool would be a perfect match to be handled with PHIVE as its a dev dependency.

Packages with classmap autoloading are ignored

90% of packages I used in one of my project has classmap src autoloading, so they are ignored with reason "Package provides no namespace". They have some namespaces, just it is not mentioned in composer

Is there a way how to use your great library with this type of packages?

Thank you for your work!

Debug: Add Exception handling for debug purpose

Currently if the parser or anything else crashes during the process of scanning the complete plugin crashes.

There should be a type of exception handling that gives more information of the problem at hand. Some sort of crash report.

• File that was scanned
• Used Strategy
• php version
• Used Packages

php-parser has own ErrorHandler. Use Collecting to collect all error during code parsing.

"NonComposerComponentRegistration.php" directory does not exist

I tried to use this tool with fresh Magento2 Installation and got this result:

composer unused

Loading packages
----------------

 Loading 1 requirements
 1/1 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%

 ! [NOTE] Found 1 packages to be checked.



  [InvalidArgumentException]
  The "/Users/kkrieger/htdocs/kkrieger/magento-2.3/app/etc/NonComposerComponentRegistration.php" directory does not exist.

Do you need more data like composer.lock?

Composer virtual packages are reported as ignored

Describe the bug

Running composer unused in a library that requires a virtual package (e.g. psr/log-implementation) composer unused is obviously not able to locate the package. Packages with the -implementation suffix should not be reported at all.

Additional information

https://devedge.wordpress.com/2014/09/27/composer-and-virtual-packages/
https://matthiasnoback.nl/2014/10/composer-provide-and-dependency-inversion/

As the excludePackage feature was added back again with #222.
This issue can utilize this implementation to actually match packages ending with -implementation to be ignored as well.

This could be done somewhere around here:
https://github.com/composer-unused/composer-unused/blob/main/src/Command/Handler/CollectFilteredDependenciesCommandHandler.php#L17

Detection of in-use packages that define no namespaces

Describe the bug
Consider the simple case:

{
    "require": {
        "paragonie/random_compat": "0.9.5",
    }
}

Random compat just defines the random_int/random_bytes functions in the global namespace for PHP5.x projects, so they can use the awesome random functions that 7.0 bought.

Since it has no namespaces, it's possibly impossible to detect if it's in use or not, yet composer unused will say:

 Unused packages
 * paragonie/random_compat ✗

I suggest that if a package has no namespaces, then it be put into a section that indicates that it's impossible to correctly identify if the package is in use or not via automated means.

This is also true of any package that defines only a static global class, such as defuse/php-encryption and bitly/bitly-api-php - again they don't actually have a namespace, so it's impossible to tell if they're in use by the namespaces being called.

Feature: Cross reference packages

Is your feature request related to a problem? Please describe.
If you required a package that is already installed by another package, you might be able to remove this package from your requirements. To help the user understand, that this package is require by another, a cross reference check should be added.

Describe the solution you'd like
A notice about if an unused package is cross reference by another one.
Smt like this:

Results
-------

 Unused packages
 * package/a ✗ (required by package/b)

ext-ds usages not detected

Describe the bug

I'm heavily dependent on ext-ds however it is reported as unused. I wonder why and what can I do to fix it.

Error dump

{"time":"2020-06-07T13:54:35.809084+00:00","level":"info","message":"version","context":{"value":"0.7.0"}}
{"time":"2020-06-07T13:54:35.809421+00:00","level":"info","message":"requires","context":{"php-64bit":"^7.2","ext-ds":"*"}}
{"time":"2020-06-07T13:54:35.809441+00:00","level":"info","message":"dev-requires","context":{"icanhazstring\/composer-unused":"^0.7.3"}}
{"time":"2020-06-07T13:54:35.809461+00:00","level":"info","message":"autoload","context":{"psr-4":{"SimPod\\Bugs\\":["src\/"]}}}
{"time":"2020-06-07T13:54:35.809480+00:00","level":"info","message":"dev-autoload","context":[]}
{"time":"2020-06-07T13:54:35.843243+00:00","level":"debug","message":"Parsing file \/Users\/user\/Work\/bugs\/src\/Example.php","context":[]}

Additional information

This is to reproduce simPod/php-bugs@e539a75

Unable to install composer-unused in private packagist package

When typing composer require --dev icanhazstring/composer-unused, I'm getting an error and I can't install this package 😕

Using version ^0.5.6 for icanhazstring/composer-unused
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Installation request for icanhazstring/composer-unused ^0.5.6 -> satisfiable by icanhazstring/composer-unused[0.5.6].
    - icanhazstring/composer-unused 0.5.6 requires zendframework/zend-servicemanager ^3.4 -> no matching package found.

Potential causes:
 - A typo in the package name
 - The package is not available in a stable-enough version according to your minimum-stability setting
   see <https://getcomposer.org/doc/04-schema.md#minimum-stability> for more details.
 - It's a private package and you forgot to add a custom repository to find it

Read <https://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.

False positives

Hi there,

Awesome idea for a package, however I am getting some false positives. In my case I am have a Laravel project, and the following packages came up as definite false positives:

`* aws/aws-sdk-php ✗

• davejamesmiller/laravel-breadcrumbs ✗
• doctrine/dbal ✗
• jeremykenedy/laravel-phpinfo ✗
• laravel/scout ✗
• laravelcollective/html ✗`

There is one more package which I'm not 100% sure about: league/oauth2-client. I will investigate that one and get back to you.

Not 100% sure why these packages are hitting false positives, but might be to do with Laravel using a few of them internally, and others are being auto-discovered by Laravel, and not being used directly within the main app code.

ext- packages need to be ignored outright for scanning

Describe the bug
Consider this example case:

{
    "require": {
        "ext-json": "*",
        "ext-pdo": "*",
        "ext-zlib": "*",
        "ext-soap": "*",
        "ext-zip": "*",
        "ext-simplexml": "*",
        "ext-dom": "*",
        "ext-curl": "*",
        "ext-calendar": "*",
        "ext-fileinfo": "*",
        "ext-iconv": "*",
        "ext-mcrypt": "*",
        "ext-openssl": "*",
        "ext-ctype": "*"
    }
}

Output:

Ignored packages
 ○ ext-json (Unable to locate package)
 ○ ext-pdo (Unable to locate package)
 ○ ext-zlib (Unable to locate package)
 ○ ext-soap (Unable to locate package)
 ○ ext-zip (Unable to locate package)
 ○ ext-simplexml (Unable to locate package)
 ○ ext-dom (Unable to locate package)
 ○ ext-curl (Unable to locate package)
 ○ ext-calendar (Unable to locate package)
 ○ ext-fileinfo (Unable to locate package)
 ○ ext-iconv (Unable to locate package)
 ○ ext-mcrypt (Unable to locate package)
 ○ ext-openssl (Unable to locate package)
 ○ ext-ctype (Unable to locate package)

Additional information
Generally these directives should just be ignored for the context of scanning. (unless you want to scan for their actual function usages? I suspect not!) - as in they shouldn't even turn up in the Ignored packages section as they're ext- requirements.

Feature: Analyse code for `ext-` packages

Is your feature request related to a problem? Please describe.
Currently ext- packages from your composer.json will be ignored silently. This means, they won't show up in the result as ignored. In the future this could be improved to even scan your code for usages from these extensions.

Describe the solution you'd like
Maybe we can find a source how to map php extensions to there provided functions. Similar to what PHPStorm is doing with the Composer Plugin.

Additional information
https://www.php.net/manual/de/function.get-extension-funcs.php

Call to undefined method PhpParser\Node\Expr\PropertyFetch::isFullyQualified()

This happens with anonymous classes

public function testSkipForNonExistentChatRooms(): void
{
    $transformer = new class ($this) implements DataTransformerInterface {
        /**
         * @var Assert
         */
        private $assert;

        public function __construct(Assert $assert)
        {
            $this->assert = $assert;
        }

        public function transform(array $data): array
        {
            $this->assert::assertEmpty($data);

            return $data;
        }
    };

    // rest of code
}

Packages only used in annotations are reported as unused

Describe the bug

If you require a package which is only used in phpdoc annotations, this package will be reported as unused.
For example if you use jms/serializer where you only define your model attributes using the @JMS\Type annotation.

Additional information

Possible solution would be to use a docblock parser to get this kind of information.
https://github.com/phpstan/phpdoc-parser

{file}.php directory does not exist

This is similar issue as #3 but this time for

"autoload": {
    "files": ["src/AppBundle/functions.php"]
},

configuration

Dump file is always created

Describe the bug
Just running composer unused creates a composer-unused-dump-* file everytime.

Additional information

• composer unused: 0.5.3
• composer: 1.8.5
• php 7.3.4

Feature: Add ability to ignore packages by definition

Is your feature request related to a problem? Please describe.
Some packages don't have a valid "type" given. Also they are hot linked in RunTime. This makes is nearly impossible to get information about usages. Until then, we should provide the ability to ignore certain packages defined in your own composer.json

Describe the solution you'd like
We provide an entry in the extra directive of the composer.json which simple gets a list of ignored packages. These are similar to the cli parameter --excludePackage and should be merged with them.

Doesn't work with yii2 projects

Describe the bug
composer unused doesn't work for Yii2 projects, the following error messages are displayed:

 [ERROR] Could not load paths from root package to scan.
 [ERROR] No usages could be found. Aborting.

Error dump
Use $ composer unused -vvv to create an error dump and add it to the issue.

Reading ./composer.json
Loading config file /Users/machour/.composer/auth.json
Loading config file ./composer.json
Checked CA file /private/etc/ssl/cert.pem: valid
Executing command (/private/var/www/hidden/www.hidden.tn/www): git branch --no-color --no-abbrev -v
Reading /Users/machour/.composer/composer.json
Loading config file /Users/machour/.composer/auth.json
Loading config file /Users/machour/.composer/composer.json
Loading config file /Users/machour/.composer/auth.json
Reading /Users/machour/.composer/auth.json
Reading /private/var/www/hidden/www.hidden.tn/www/vendor/composer/installed.json
Reading /Users/machour/.composer/vendor/composer/installed.json
Loading plugin Foxy\Foxy
Reading ./composer.lock
Executing command (CWD): npm --version
Loading plugin yii\composer\Plugin
Loading plugin Icanhazstring\Composer\Unused\UnusedPlugin
Loading plugin SLLH\ComposerVersionsCheck\VersionsCheckPlugin
Running 1.8.0 (2018-12-03 10:31:16) with PHP 7.3.0 on Darwin / 18.2.0

Loading packages
----------------

 Loading 36 requirements
 36/36 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100% < 1 sec/< 1 sec 12.0 MiB

 ! [NOTE] Skipped 8 requirements. No package found or invalid constraint.

 * php
 * ext-gd
 * ext-json
 * ext-tidy
 * ext-pdo
 * ext-mbstring
 * ext-soap
 * yiisoft/yii2-redis

 ! [NOTE] Found 28 package(s) to be checked.


 [ERROR] Could not load paths from root package to scan.



 [ERROR] No usages could be found. Aborting.

Additional information

Reproduce steps:

composer create-project --prefer-dist --stability=dev yiisoft/yii2-app-basic basic
cd basic
composer unused

This has probably every thing to do with the way Yii2 handles autoloading (check basic/web/index.php):

require __DIR__ . '/../vendor/autoload.php';
require __DIR__ . '/../vendor/yiisoft/yii2/Yii.php';

Feature: Consider composer suggest packages to ignore

Is your feature request related to a problem? Please describe.
Sometime a required package provide a suggested package to install. You won't use this package inside your main application, but the 3rd party package does. This will come up as a false-positive.

Describe the solution you'd like
We should take the suggest block of required packages into account and ignore packages that are unused that are listed as that.

Exit code reflects unused packages exist

Is your feature request related to a problem? Please describe.
I want to put this tool in my CI pipeline, and for it to fail this step when there are unused packages.

Describe the solution you'd like
The solution is to make the composer unused exit with a code > 0 when there are unused packages detected.

phar 0.7.2 throws a fatal error

Describe the bug

Running the latest phar (0.7.2) throws a fatal error.

Steps to reproduce:

curl -Ls https://github.com/composer-unused/composer-unused/releases/download/0.7.2/composer-unused.phar > composer-unused.phar
php composer-unused.phar

Error dump

PHP Fatal error:  Uncaught Error: Class 'Composer\Console\Application' not found in phar:///Users/kuba/Projects/toolbox/cu2.phar/bin/composer-unused:39
Stack trace:
#0 phar:///Users/kuba/Projects/toolbox/cu2.phar/bin/composer-unused(52): {closure}(Array)
#1 /Users/kuba/Projects/toolbox/cu2.phar(14): require('phar:///Users/k...')
#2 {main}
  thrown in phar:///Users/kuba/Projects/toolbox/cu2.phar/bin/composer-unused on line 39

Composer.json without require entries should not be an error

Describe the bug

A composer.json with no require entries seems to be a problem as the exit code is non zero and thus kills CI or other following scripts. Having nothing to check should not be per-se an error. When nothing is there to be checked anymore it is an error having this tool still required, check. When nothing is there to be checked yet is it not an error. This keeps me from preparing a repository so I can't use this tool without having a problem that I am not aware of yet.

Error dump

composer.json

{
    "name": "foo/bar",
    "description": "foobar",
    "type": "library",
    "minimum-stability": "stable",
    "extra": {
        "unused": [
            "php"
        ]
    },
    "require": {
        "php": ">=7.4 <7.5"
    },
    "autoload": {
        "psr-4": {
            "Foo\\Bar\\": "src/"
        }
    },
    "require-dev": {
        "phpunit/phpunit": ">=9.1 <10",
        "phpstan/phpstan": ">=0.12 <0.13",
        "phpstan/extension-installer": ">=1 <2",
        "phpstan/phpstan-phpunit": ">=0.12 <0.13",
        "phpstan/phpstan-deprecation-rules": ">=0.12 <0.13",
        "phpstan/phpstan-strict-rules": ">=0.12 <0.13",
        "psalm/plugin-phpunit": ">=0.10 <0.11",
        "vimeo/psalm": ">=3 <4",
        "infection/infection": ">=0.15 <0.16",
        "friendsofphp/php-cs-fixer": ">=2 <3",
        "icanhazstring/composer-unused": ">=0.7 <0.8"
    },
    "autoload-dev": {
        "psr-4": {
            "Foo\\Bar\\Test\\": "test/"
        }
    }
}

Command

vendor/bin/composer-unused --no-progress -vvv

Plugin command unused (Icanhazstring\Composer\Unused\Command\UnusedCommand) would override a Composer command and has been skipped
Running 1.10.6 (2020-05-06 10:28:10) with PHP 7.4.6 on Darwin / 19.3.0
You are running composer with Xdebug enabled. This has a major impact on runtime performance. See https://getcomposer.org/xdebug

Loading packages
----------------

 ! [NOTE] Found 0 package(s) to be checked.                                                                             
                                                                                                                        
 [ERROR] No required packages found                                                                                                                                                                                                             

Log

{"time":"2020-05-16T15:12:01.071365+00:00","level":"info","message":"version","context":{"value":"0.7.0"}}
{"time":"2020-05-16T15:12:01.071514+00:00","level":"info","message":"requires","context":{"php":">=7.4 <7.5"}}
{"time":"2020-05-16T15:12:01.071529+00:00","level":"info","message":"dev-requires","context":{"phpunit\/phpunit":">=9.1 <10","phpstan\/phpstan":">=0.12 <0.13","phpstan\/extension-installer":">=1 <2","phpstan\/phpstan-phpunit":">=0.12 <0.13","phpstan\/phpstan-deprecation-rules":">=0.12 <0.13","phpstan\/phpstan-strict-rules":">=0.12 <0.13","psalm\/plugin-phpunit":">=0.10 <0.11","vimeo\/psalm":">=3 <4","infection\/infection":">=0.15 <0.16","friendsofphp\/php-cs-fixer":">=2 <3","icanhazstring\/composer-unused":">=0.7 <0.8"}}
{"time":"2020-05-16T15:12:01.071541+00:00","level":"info","message":"autoload","context":{"psr-4":{"Foo\\Bar\\":"src\/"}}}
{"time":"2020-05-16T15:12:01.071551+00:00","level":"info","message":"dev-autoload","context":{"psr-4":{"Foo\\Bar\\Test\\":"test\/"}}}

swiftmailer/swiftmailer false positive?

Can somebody confirm this? We use Swift_Mailer typehint in __construct and despite that it's marked as unused.

Improve CONTRIBUTE.md with better instruction

Currently the CONTRIBUTE.md only has information about local development. But it does not give you information about how to clone it and require it globally so you can test it against one of your repositories.

This is a common use case, where you required composer unused globally but encountered a bug with your project which you want to resolve.

Following this should be added

• information about the path configuration for composer https://getcomposer.org/doc/05-repositories.md#path
• step by step information where and what to change to make this work

Allow scanning of files that are not in namespaces but consume namespaces

Currently the code seems to only scan psr0/4, classmap and files directives. However, we have a large Cake2 project where the bulk of our files are not namespaced. They still use composer dependencies.

An example high level directory structure is like (in our case):

bin/
Config/
Console/
Controller/
Lib/
Model/
Plugin/
src/
Test/
vendor/
View/
webroot/
composer.json
composer.lock

While /src contains a section of our code which is namespaced, our MVC files are in either the Controller/Model/View directories, or in the Plugin directory. These have no namespace, but do consume namespaces.

It would be handy if the tool could scan those files as well, as currently the output of unused is correct if we are only talking about the src directory. The rest of the "unused" packages are consumed in our MCV structure (or at least I'd like to think so!)

Feature: Additional cli parameter --exclude

Is your feature request related to a problem? Please describe.
Related to #12 and #11. This should solve problem with false positives where configs and other directories are not parsed using composer.json directives only. This was already reworked so should work. The problem with that is, that now there could be some files that should not be parsed. The new parameter should be able to exclude a list of folders to ignore.

Describe the solution you'd like
Add inputArgument --exclude which should be an array, so calls like this can be made:

$ composer unused --exclude="vendor" --exclude="legacy"

Support type "symfony-bundle"

Is your feature request related to a problem? Please describe.
In #25 you ignored packages that are not of type library. This excludes Symfony bundles as well, most of them use the type symfony-bundle (1, 2, 3, 4, ...).

Describe the solution you'd like
I'd like to be able to scan whether a Symfony bundle is used or not. Symfony bundles are registered with their FQCN in app/AppKernel.php or in config/bundles.php (Symfony Flex). Therefore symfony-bundle should be supported.

icanhazstring/composer-unused usages not detected

Describe the bug

icanhazstring/composer-unused is reported as unused.

Additional information

This is to reproduce simPod/php-bugs@d8c3b26

False positives #2

Describe the bug
Some packages show as not used, but they are in fact used.

 Unused packages
 * beberlei/doctrineextensions ✗ (config/config.yaml as `DoctrineExtensions\Query\Mysql\Regexp`)
 * overblog/dataloader-bundle ✗  (config/bundles.php)
 * perftools/xhgui-collector ✗ (web/app.php as `require_once __DIR__ . '/../vendor/perftools/xhgui-collector/external/header.php';`)
 * symfony/monolog-bundle ✗ (config/bundles.php)

Additional information
config/bundles.php

<?php

declare(strict_types=1);

return [
    // ...
    Symfony\Bundle\MonologBundle\MonologBundle::class => ['all' => true],
    // ...
    Overblog\DataLoaderBundle\OverblogDataLoaderBundle::class => ['all' => true],
    // ...
];

Installation via phive fails

It worked a week ago ;-)

Seems like it is signed with a new signing key, that has not yet been uploaded to the keyservers?

$ phive.phar install composer-unused
Phive 0.14.2 - Copyright (C) 2015-2020 by Arne Blankerts, Sebastian Heuer and Contributors
Fetching repository list
Downloading https://github.com/composer-unused/composer-unused/releases/download/0.7.2/composer-unused.phar
Downloading https://github.com/composer-unused/composer-unused/releases/download/0.7.2/composer-unused.phar.asc
Downloading key F4D32E2C9343B2AE
Trying to connect to keys.openpgp.org (37.218.245.50)
Downloading https://keys.openpgp.org/pks/lookup?op=get&options=mr&search=0xF4D32E2C9343B2AE
Successfully downloaded key.
[WARNING]  Parsing key data failed with error code 0: No UIDs in key found
Trying to connect to keyserver.ubuntu.com (162.213.33.8)
Trying to connect to keyserver.ubuntu.com (162.213.33.9)
[WARNING]  Failed with error code 404: Key not found on keyserver
Trying to connect to hkps.pool.sks-keyservers.net (82.148.229.254)
Trying to connect to hkps.pool.sks-keyservers.net (2a00:1b98:1:4::254:0)
[ERROR]    Request failed: OpenSSL SSL_connect: Connection refused in connection to hkps.pool.sks-keyservers.net:443  (while requesting https://hkps.pool.sks-keyservers.net/pks/lookup?op=get&options=mr&search=0xF4D32E2C9343B2AE)
[WARNING]  Failed with error code 404: Key not found on keyserver
[ERROR]    PublicKey F4D32E2C9343B2AE not found on key servers

[ErrorException] strpos(): Empty needle

Describe the bug
Running composer unused on a big project throws an ErrorException.

Error dump

composer unused -vvv                                                                                                                                                                                       177.74.239.146  1 ↵
Reading ./composer.json
Loading config file /Users/naroga/.composer/config.json
Loading config file /Users/naroga/.composer/auth.json
Loading config file ./composer.json
Checked CA file /private/etc/ssl/cert.pem: valid
Executing command (/Users/naroga/Projects/<redacted>): git branch --no-color --no-abbrev -v
Executing command (/Users/naroga/Projects/<redacted>): git rev-list develop..QU-3465
Reading /Users/naroga/.composer/composer.json
Loading config file /Users/naroga/.composer/config.json
Loading config file /Users/naroga/.composer/auth.json
Loading config file /Users/naroga/.composer/composer.json
Loading config file /Users/naroga/.composer/auth.json
Reading /Users/naroga/.composer/auth.json
Reading /Users/naroga/Projects/<redacted>/vendor/composer/installed.json
Reading /Users/naroga/.composer/vendor/composer/installed.json
Loading plugin Icanhazstring\Composer\Unused\UnusedPlugin
Running 1.7.2 (2018-08-16 16:57:12) with PHP 7.2.10 on Darwin / 18.2.0

Loading packages
----------------

 Loading 57 requirements
 57/57 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100% < 1 sec/< 1 sec 14.0 MiB

 ! [NOTE] Skipped 1 requirements. No package found or invalid constraint.                                               

 * php

 ! [NOTE] Found 56 package(s) to be checked.                                                                            

Scanning files from basedir /Users/naroga/Projects/<redacted>
---------------------------------------------------------------

 5528/5528 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100% 17 secs/17 secs 156.0 MiB


                          
  [ErrorException]        
  strpos(): Empty needle  
                          

Exception trace:
 () at /Users/naroga/.composer/vendor/icanhazstring/composer-unused/src/Subject/PackageSubject.php:29
 Composer\Util\ErrorHandler::handle() at n/a:n/a
 strpos() at /Users/naroga/.composer/vendor/icanhazstring/composer-unused/src/Subject/PackageSubject.php:29
 Icanhazstring\Composer\Unused\Subject\PackageSubject->providesNamespace() at /Users/naroga/.composer/vendor/icanhazstring/composer-unused/src/Command/UnusedCommand.php:121
 Icanhazstring\Composer\Unused\Command\UnusedCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:241
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:843
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:193
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:254
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:117
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:103
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:56
 require() at /usr/local/bin/composer:24

unused [-xd|--excludeDir EXCLUDEDIR] [-xp|--excludePackage EXCLUDEPACKAGE]

Additional information
No apparent memory issues, running on OSX:

PHP 7.2.10 (cli) (built: Sep 14 2018 07:07:08) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.10, Copyright (c) 1999-2018, by Zend Technologies

Namespaces of vendor aren't analyzed in config files of Symfony

Describe the bug

I've installed your tool for the first time on my symfony project. In my project I use such bundles and libraries: oneup/flysystem-bundle, superbalist/flysystem-google-storage, google/cloud. It is needed to upload files to Google Cloud Storage.

Files from google/cloud aren't used anywhere in my code directly. They are only described once in the settings of oneup/flysystem-bundle. Here is how config looks like

oneup_flysystem:
    adapters:
        file_adapter:
            googlecloudstorage:
                client: Google\Cloud\Storage\StorageClient
                bucket: Google\Cloud\Storage\Bucket
                prefix: ~
    filesystems:
        file_fs:
            adapter: file_adapter
            mount: file_fs
            visibility: public

As you can this, this library is used only in config files, but it is required any way. And any other package in composer.json haven't it in required section of composer.json :(

Additional information

I understand that it is not really a bug, and can be discussed. Maybe you can suggest something. RIght now I've added google/cloud to the extra parameters on composer.json

    "extra": {
        "unused": [
            "google/cloud"
        ]
    }

I think it can be solved like an additional plugin for Symfony, which also analyzes dependencies from config files.

Check functions from file autoloading

Describe the bug

A function from a composer dependency is used but its usage is not detected. I assume it is about a function that is provided via files autoloading: https://github.com/bpolaszek/php-iterable-functions/blob/0cc66fecec909546752b67215af72acbb66445e3/composer.json#L10

Additional information

{
    "require": {
        "php": ">=7.4",
        "bentools/iterable-functions": ">=1.4"
    },
    "autoload": {
        "psr-4": {
            "FooBar\\": "src/"
        }
    },
    "require-dev": {
        "icanhazstring/composer-unused": ">=0.7"
    }
}