Currently, the plugin tracks dependencies while analysis is in progress, but can only track partial dependencies, until a limit is reached. This makes the plugin not as powerful as it should be, and it also adds a dependency on the order in which classes analyzed, which should be well known to whoever has ever noticed random taint-check issues appearing on unrelated patch sets, as well as whoever (at least myself) has ever tried debugging a taint-check issue on MW core step-by-step.

To resolve this, using analyze-twice (T269816) might help, although if I'm not mistaken, dependencies would still be partial, although more complete.

A better solution is probably to first track all dependencies in a sort of "pre-analysis" phase, creating a huge graph, then using that graph during the "normal" phase. This is already not straightforward, as it's a massive refactor, but there are also some specific things to keep in mind:

• In order to infer dependencies, we need to know some things (e.g. union types) that can only be determined after phan has analyzed a node. This is the major obstacle, because our "infer dependencies" phase would need to happen while or after the main analysis phase, but not before.
• Phan currently doesn't allow something like this. It does allow something vaguely similar, that is, it has a BeforeAnalyzePhaseCapability (used e.g. in InferPureVisitor to infer which methods are pure), but as per the previous bullet, this isn't suitable because it runs before the analyze phase

I think what should probably be done is, determine how the new visitor should act, carefully plan its implementation and then, if the above is correct, check up with upstream and see whether it's possible to add a hook to phan for some process to run after the analysis phase. Or maybe, phan already offers the hooks we need, and it might be possible to implement this with a combination of PostAnalyzeNodeCapability and FinalizeProcessCapability; I haven't really checked accurately.

At any rate, this is not going to be easy, and I'm not even sure if I can do this myself within a reasonable amount of time.