Why you "it's not good"? With your thinking we must change ~60+% of packages of bundles at Packagist cause they __don't__ declare every dependency they use if that dependency is used by it's _requirements_.

Not looking far away, let's see Symfony [WebProfilerBundle](https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/WebProfilerBundle/composer.json#L20-L22), you have 3 hard + 3 soft deps, let's see code for _missing_ (from your PoV) deps: [1](https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php#L14-L15), [2](https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php#L15), [3](https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php#L18)...

We could go further, but I don't see any point in this.