chore: require all directly used packages

CHANGELOG.md

@@ -8,6 +8,8 @@ See [keep a changelog] for information about writing changes to this log.
 
 ## [Unreleased]
 
+- [PR-73](https://github.com/itk-dev/event-database-api/pull/73)
+  Require all directly used packages in `composer.json`, checked by PHPStan (`pb30/phpstan-composer-analysis`)
 - [PR-72](https://github.com/itk-dev/event-database-api/pull/72)
   Update Elasticsearch to 8.19.23 and remove the unused RabbitMQ service
 - [PR-71](https://github.com/itk-dev/event-database-api/pull/71)

composer.json

@@ -12,26 +12,37 @@
         "nelmio/cors-bundle": "^2.4",
         "phpdocumentor/reflection-docblock": "^5.6",
         "phpstan/phpdoc-parser": "^2.2",
+        "psr/container": "^2.0",
         "symfony/asset": "~7.4.0",
         "symfony/console": "~7.4.0",
+        "symfony/dependency-injection": "~7.4.0",
         "symfony/dotenv": "~7.4.0",
         "symfony/expression-language": "~7.4.0",
         "symfony/flex": "^2",
         "symfony/framework-bundle": "~7.4.0",
         "symfony/http-client": "~7.4.0",
+        "symfony/http-client-contracts": "^3.7",
+        "symfony/http-foundation": "~7.4.0",
+        "symfony/http-kernel": "~7.4.0",
         "symfony/property-access": "~7.4.0",
         "symfony/property-info": "~7.4.0",
+        "symfony/routing": "~7.4.0",
         "symfony/runtime": "~7.4.0",
         "symfony/security-bundle": "~7.4.0",
+        "symfony/security-core": "~7.4.0",
+        "symfony/security-http": "~7.4.0",
         "symfony/serializer": "~7.4.0",
+        "symfony/string": "~7.4.0",
         "symfony/twig-bundle": "~7.4.0",
+        "symfony/type-info": "~7.4.0",
         "symfony/validator": "~7.4.0",
         "symfony/yaml": "~7.4.0"
     },
     "require-dev": {
         "ergebnis/composer-normalize": "^2.47",
         "friendsofphp/php-cs-fixer": "^3.86",
         "justinrainbow/json-schema": "^6.10",
+        "pb30/phpstan-composer-analysis": "^1.1",
         "phpstan/extension-installer": "^1.4",
         "phpstan/phpstan": "^2.1",
         "phpstan/phpstan-strict-rules": "^2.0",

phpstan.dist.neon

@@ -17,3 +17,10 @@ parameters:
         - identifier: missingType.iterableValue
         # The ID properties are set reflectively by API Platform.
         - '#Property App\\Api\\Dto\\[^\\]+::\$id is unused#'
+    # pb30/phpstan-composer-analysis: report packages used directly but only installed transitively ("shadow
+    # dependencies") and dev packages used in production code. Unused/misplaced checks are off: bundles and
+    # extensions are used through config, not class references, so they would all be false positives.
+    composerAnalysis:
+        ignoreAllUnusedDeps: true
+        ignoreAllProdDepsInDev: true
+        disableExtensionsAnalysis: true