From 2c1ad3845a36d4f9a5493ae11512b330ca2c6a9a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 28 Oct 2026 16:59:45 +0000 Subject: [PATCH 1/2] Declare Composer dependencies the package uses Require ext-openssl, the Illuminate components called from the package, and nesbot/carbon on the Laravel 11-13 range. Require orchestra/testbench-core for the test case class. Drop illuminate/contracts, which the package does not reference. Co-authored-by: Jordan Partridge --- README.md | 5 +++-- composer.json | 9 ++++++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index b0f56e4..219008d 100644 --- a/README.md +++ b/README.md @@ -389,8 +389,9 @@ Failed responses are mapped in `GithubConnector`: ## Requirements -- PHP 8.2, 8.3, or 8.4 -- Laravel 11, 12, or 13 (`illuminate/contracts`) +- PHP 8.2, 8.3, or 8.4, with the OpenSSL extension +- Laravel 11, 12, or 13 (`illuminate/collections`, `illuminate/console`, `illuminate/http`, `illuminate/process`, and `illuminate/support`) +- `nesbot/carbon` ^2.72.6 or ^3.8.4 - `saloonphp/saloon` ^4.3 - `firebase/php-jwt` ^7.0, used by GitHub App authentication - `spatie/laravel-package-tools` ^1.16 or ^2.0 diff --git a/composer.json b/composer.json index b6c9099..bcc6176 100644 --- a/composer.json +++ b/composer.json @@ -26,8 +26,14 @@ ], "require": { "php": "^8.2", + "ext-openssl": "*", "firebase/php-jwt": "^7.0", - "illuminate/contracts": "^11.0||^12.0||^13.0", + "illuminate/collections": "^11.0||^12.0||^13.0", + "illuminate/console": "^11.0||^12.0||^13.0", + "illuminate/http": "^11.0||^12.0||^13.0", + "illuminate/process": "^11.0||^12.0||^13.0", + "illuminate/support": "^11.0||^12.0||^13.0", + "nesbot/carbon": "^2.72.6||^3.8.4", "saloonphp/saloon": "^4.3", "spatie/laravel-package-tools": "^1.16|^2.0" }, @@ -36,6 +42,7 @@ "larastan/larastan": "^2.0||^3.0", "nunomaduro/collision": "^7.0||^8.0||^9.0", "orchestra/testbench": "^8.0||^9.0||^10.0||^11.0||^12.0", + "orchestra/testbench-core": "^8.0||^9.0||^10.0||^11.0||^12.0", "pestphp/pest": "^2.34||^3.0||^4.0", "pestphp/pest-plugin-arch": "^2.7||^3.0||^4.0", "pestphp/pest-plugin-laravel": "^2.3||^3.0||^4.0", From 38a3e3478b8b0653aa63208b68e086a5173a29f8 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 28 Oct 2026 17:02:39 +0000 Subject: [PATCH 2/2] Run composer-dependency-analyser in the test workflow Add the analyser as a dev dependency and run it after composer validate. Ignore only the false positive where laravel/framework replaces illuminate/*. Co-authored-by: Jordan Partridge --- .gitattributes | 1 + .github/workflows/run-tests.yml | 10 ++++++++++ composer-dependency-analyser.php | 20 ++++++++++++++++++++ composer.json | 3 ++- 4 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 composer-dependency-analyser.php diff --git a/.gitattributes b/.gitattributes index 70d08e4..9d6b713 100644 --- a/.gitattributes +++ b/.gitattributes @@ -13,6 +13,7 @@ .gitignore export-ignore .phpactor.json export-ignore CHANGELOG.md export-ignore +composer-dependency-analyser.php export-ignore docs/ export-ignore phpstan-baseline.neon export-ignore phpstan-bootstrap.php export-ignore diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml index 2d2a281..aa64e7f 100644 --- a/.github/workflows/run-tests.yml +++ b/.github/workflows/run-tests.yml @@ -69,10 +69,20 @@ jobs: - name: Install dependencies run: | + # The matrix pins below rewrite composer.json for this job only. + # Put the published file back before validate and the dependency analyser. + cp composer.json "$RUNNER_TEMP/composer.json.orig" composer remove --dev --no-update larastan/larastan phpstan/phpstan-deprecation-rules phpstan/phpstan-phpunit phpstan/extension-installer composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update composer require --dev --no-update "nunomaduro/collision:^8.0" composer update --${{ matrix.stability }} --prefer-dist --no-interaction --with-all-dependencies + mv "$RUNNER_TEMP/composer.json.orig" composer.json + + - name: Validate composer.json + run: composer validate --strict --no-check-lock + + - name: Analyse composer dependencies + run: vendor/bin/composer-dependency-analyser - name: Execute tests run: vendor/bin/pest diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php new file mode 100644 index 0000000..562aba4 --- /dev/null +++ b/composer-dependency-analyser.php @@ -0,0 +1,20 @@ +ignoreErrorsOnPackage('laravel/framework', [ErrorType::SHADOW_DEPENDENCY]) + ->ignoreErrorsOnPackages( + [ + 'illuminate/collections', + 'illuminate/console', + 'illuminate/http', + 'illuminate/process', + 'illuminate/support', + ], + [ErrorType::UNUSED_DEPENDENCY], + ); diff --git a/composer.json b/composer.json index bcc6176..9ed70c1 100644 --- a/composer.json +++ b/composer.json @@ -48,7 +48,8 @@ "pestphp/pest-plugin-laravel": "^2.3||^3.0||^4.0", "phpstan/extension-installer": "^1.3", "phpstan/phpstan-deprecation-rules": "^1.1||^2.0", - "phpstan/phpstan-phpunit": "^1.3||^2.0" + "phpstan/phpstan-phpunit": "^1.3||^2.0", + "shipmonk/composer-dependency-analyser": "^1.8" }, "autoload": { "psr-4": {