private function determineUnusedCodeViolations(
        Composer $composer,
        CandidateInterface ...$candidates
    ): array {
        $repository = $composer->getRepositoryManager()->getLocalRepository();
        $package    = $composer->getPackage();

        $violations   = [];
        $installed    = [];
        $requirements = array_keys($package->getRequires());
        $packages     = array_map(
            function (CandidateInterface $candidate) : string {
                return $candidate->getPackage()->getName();
            },
            $candidates
        );

        foreach ($repository->getPackages() as $package) {
            $installed[$package->getName()] = $package;
        }

        foreach ($requirements as $requirement) {
            // Platform requirements aren't part of this test.
            if (strpos($requirement, '/') === false) {
                continue;
            }

            // The package is never installed.
            if (!array_key_exists($requirement, $installed)) {
                continue;
            }

            /** @var PackageInterface $package */
            $package = $installed[$requirement];

            // A meta package would not introduce code symbols.
            if ($package->getType() === 'metapackage') {
                continue;
            }

            if (!in_array($requirement, $packages, true)) {
                $violations[] = new Violation(
                    sprintf(
                        'Package "%s" is installed, but never used.',
                        $requirement
                    ),
                    new Candidate($package, new SymbolIterator())
                );
            }
        }

        return $violations;
    }