[Question] Remove more dependencies from new Symfony applications? about flex HOT 17 CLOSED

From 28 to 19, nice! 👏

from flex.

I've done a lot of work in 3.3 to remove as many deps as possible. 3.4 will be the occasion to try removing some more, but I'm not sure we will be able to remove lots of them.

from flex.

symfony/polyfill-php56 and symfony/polyfill-php70 will be removed in Symfony 4.0 as the min PHP version will be PHP 7. That's 2 less deps for free.

from flex.

symfony/security-core depending on symfony/polyfill-util is bunk. So that's 4 off the list that will be removed when the minimum php version is bumped.

from flex.

And symfony/class-loader will be removed in 4.0 too, as the component is deprecated (it is used only by BC layers of FrameworkBundle)

from flex.

paragonie/random-compat will also not be installed when the PHP 7.0 polyfill is not installed.

from flex.

So, actually there's these four packages that could be looked into:

• doctrine/cache (required by symfony/framework-bundle)
• symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle)
• symfony/stopwatch (required by symfony/framework-bundle)

from flex.

@xabbuh is it symfony/security or symfony/security-core ? We should avoid dependencies on symfony/security as much as we can, as this is not the leaf of subtree splits (we should push other packages to depend on the actual security components they need btw).

symfony/stopwatch is here to register the profiling tool to build the timeline panel of the profiler (and yes, the profiler itself is part of HttpKernel and FrameworkBundle. WebProfilerBundle is only about the web UI allowing to read data from the profiler, not about collecting data).

Regarding doctrine/cache, I think it is related to the caching of annotations

from flex.

No, it's symfony/security-core (I just copied the list from the issue description).

The Stopwatch IMO is not necessarily a hard requirement. Most of the times you will probably not use the profiler in production.

from flex.

But then, it means people would have to depend on it explicitly to benefit from this panel in the profiler. And we have to make the registration conditional (which is a BC break btw, as some bundles might expect that the service is there when FrameworkBundle is enabled)

from flex.

Sure, but the same was already true for the other changes that we made to dependencies there.

from flex.

looks like symfony/security-core and symfony/security-csrf are products of a bad merge (see symfony/symfony#22715) and we already removed them before (see symfony/symfony#20075)

from flex.

@xabbuh I've just executed composer create-project symfony/skeleton:3.3.x-dev and the resulting dependencies are exactly the same. According to your comment, should the security dependencies be gone by now?

from flex.

@javiereguiluz yeah, the PR fixing the bad merge is not merged yet. this is why you still have it

from flex.

see symfony/symfony#23131 and symfony/symfony#23148

from flex.

Closing this one as the two mentioned PRs on symfony/symfony removes the two remaining dependencies.

from flex.

For the record, here are the deps installed when using Flex on Symfony 4.0:

psr/cache                    dev-master 78c5a01 Common interface for caching libraries
psr/container                dev-master b7ce3b1 Common Container Interface (PHP FIG PSR-11)
psr/log                      dev-master 4ebe3a8 Common interface for logging libraries
psr/simple-cache             dev-master 753fa59 Common interfaces for simple caching
symfony/cache                dev-master d33f0c2 Symfony Cache component with PSR-6, PSR-16, and tags
symfony/config               dev-master 0ab9fdc Symfony Config Component
symfony/debug                dev-master 2b1c9fd Symfony Debug Component
symfony/dependency-injection dev-master b0a214c Symfony DependencyInjection Component
symfony/dotenv               dev-master db3fc46 Registers environment variables from a .env file
symfony/event-dispatcher     dev-master 96440b5 Symfony EventDispatcher Component
symfony/filesystem           dev-master d3c60ec Symfony Filesystem Component
symfony/finder               dev-master d04fb01 Symfony Finder Component
symfony/flex                 dev-master 40802c3
symfony/framework-bundle     dev-master 862a108 Symfony FrameworkBundle
symfony/http-foundation      dev-master a823a2f Symfony HttpFoundation Component
symfony/http-kernel          dev-master ae2ad6d Symfony HttpKernel Component
symfony/polyfill-mbstring    dev-master f29dca3 Symfony polyfill for the Mbstring extension
symfony/routing              dev-master 5b8196a Symfony Routing Component
symfony/yaml                 dev-master 2a18a53 Symfony Yaml Component

from flex.