dimionx/phpstan-rules

Rule for PHPStan that detects when production code depends on classes from Composer dev-dependencies, with flexible configuration to selectively allow certain classes or namespaces where needed.

1.0.2 2025-11-30 17:23 UTC

Requires

• php: ^8.0
• phpstan/phpstan: ^2.0

Requires (Dev)

• dimionx/dev-prod-package: dev-master
• dimionx/only-dev-package: dev-master
• dimionx/only-prod-package: dev-master
• friendsofphp/php-cs-fixer: ^3.2
• nette/neon: ^3.3.1
• pestphp/pest: ^1.22 || ^2.0 || ^3.0
• pestphp/pest-plugin-parallel: ^1.2
• phpstan/phpstan-deprecation-rules: ^1.2 || ^2.0
• spaze/coding-standard: ^1.8

MIT

• Andrey Kapitanov

• composer
• static analysis
• PHPStan
• phpstan-rule
• dev-dependencies

README

PHPStan rule to detect usage of Composer dev-dependency classes in production code, with powerful configuration to re-allow specific classes or namespaces in places where they should be allowed.

Installation

Install the extension using Composer:

composer require --dev dimionx/phpstan-rules

Manual installation

For manual installation, add this to your phpstan.neon:

includes:
    - vendor/dimionx/phpstan-rules/extension.neon

Ignoring Errors

Only ignore errors for code that is never executed in production. Typical examples include:

• Test files (*Test.php, */Tests/*, */tests/*)
• Test helpers and utilities used exclusively in tests
• Development-only scripts and tools
• Fixture factories used solely for testing
• Code generation scripts used during development

# phpstan.neon
parameters:
  ignoreErrors:
    # Ignore files that are allowed to use dev-packages
    -
      identifier: dev.packageUsedInProductionRule
      path: '*/Tests/*'

Features

• Detects accidental usage of dev-dependency classes in production code
• Configurable autoload types (PSR-4, PSR-0, classmap, files)
• Namespace-based detection for comprehensive coverage
• Flexible allowlists for legitimate cross-environment usage
• composer.lock analysis for accurate dependency mapping