[turegjorup]

Require all packages that the code uses directly, and let PHPStan check this. This is step 3 of the quarterly update.

Changes

• Add pb30/phpstan-composer-analysis (^1.1) to require-dev. Configure it in phpstan.dist.neon with the same settings as event-database-imports (chore: require all directly used packages event-database-imports#117), without additionalDevPaths.
• Add the 10 packages that the code uses directly, but that were only installed as transitive dependencies. Each constraint agrees with the installed version:
  • psr/container ^2.0
  • symfony/dependency-injection, symfony/http-foundation, symfony/http-kernel, symfony/routing, symfony/security-core, symfony/security-http, symfony/string, symfony/type-info ~7.4.0
  • symfony/http-client-contracts ^3.7
• composer.lock adds only pb30/phpstan-composer-analysis and shipmonk/composer-dependency-analyser. No installed version changes.

Why

The quarterly update runs composer update --with-all-dependencies. A package that is only a transitive dependency can then get a new major version that nobody chose. With the packages in composer.json, Composer keeps them in the given versions.

The PHPStan check fails in CI if new code uses a package that is not in composer.json.

Checks

• PHPStan: no errors. Rector dry-run: no changes.
• composer validate --strict and composer normalize --dry-run: no problems.
• PHPUnit on PHP 8.5.12: all tests pass.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.39%. Comparing base (9a35018) to head (7136c17).
⚠️ Report is 6 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop      #73   +/-   ##
==========================================
  Coverage      74.39%   74.39%           
  Complexity       264      264           
==========================================
  Files             30       30           
  Lines            738      738           
==========================================
  Hits             549      549           
  Misses           189      189           

Flag	Coverage Δ
unittests	74.39% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.