[kassner]

> I would recommend declaring the phar dependency with phive

+1. This eliminates a whole class of bugs in which you declared phpunit as a dev dependency but end up using a class that it brought in without declaring as a regular dependency. Without an external linter, you can’t really catch that until your production code doesn’t bring the class in and throws a fatal error.

[Oxodao]

1. Just add phpcsfixer and phpstan like any sane project

2. If you use phpunit class in prod code, you deserve to get a fatal error

[kassner]

1. Both tools will not catch it, you need something like https://github.com/maglnet/ComposerRequireChecker

2. That doesn’t apply to PHPUnit specifically, but if you, for example, import PHP-cs-fixer as dev dependency, it will bring symfony/console, and if you rely on that on your own code without importing it on composer.json as a regular dependency, the class will be missing when you composer install for production.

[Oxodao]

Ok I get what you're saying now, that's fair. Tbh I mainly do Symfony so most of what dev-dependencies use are already in the dependencies for me so it never happened