[Question] Remove more dependencies from new Symfony applications?

[javiereguiluz]

These are all the dependencies of a fresh Symfony app installed with Symfony Flex:

doctrine/cache               dev-master 0da649f           Caching library offering an object-oriented API for...
paragonie/random_compat      v2.0.10                      PHP 5.x polyfill for random_bytes() and random_int(...
psr/cache                    dev-master 78c5a01           Common interface for caching libraries
psr/container                dev-master b7ce3b1           Common Container Interface (PHP FIG PSR-11)
psr/log                      dev-master 4ebe3a8           Common interface for logging libraries
psr/simple-cache             dev-master 753fa59           Common interfaces for simple caching
symfony/cache                dev-master c9a100e           Symfony Cache component with PSR-6, PSR-16, and tags
symfony/class-loader         dev-master 2d60d55           Symfony ClassLoader Component
symfony/config               dev-master e068d79           Symfony Config Component
symfony/debug                dev-master 105f6a2           Symfony Debug Component
symfony/dependency-injection dev-master fab99da           Symfony DependencyInjection Component
symfony/dotenv               dev-master 56422dc           Registers environment variables from a .env file
symfony/event-dispatcher     dev-master 6813d5f           Symfony EventDispatcher Component
symfony/filesystem           dev-master 8de5137           Symfony Filesystem Component
symfony/finder               dev-master 851a876           Symfony Finder Component
symfony/flex                 dev-fix_configurator f7d1854
symfony/framework-bundle     dev-master ea46867           Symfony FrameworkBundle
symfony/http-foundation      dev-master 09aebc3           Symfony HttpFoundation Component
symfony/http-kernel          dev-master d95c776           Symfony HttpKernel Component
symfony/polyfill-mbstring    dev-master e79d363           Symfony polyfill for the Mbstring extension
symfony/polyfill-php56       dev-master 1dd42b9           Symfony polyfill backporting some PHP 5.6+ features...
symfony/polyfill-php70       dev-master 13ce343           Symfony polyfill backporting some PHP 7.0+ features...
symfony/polyfill-util        dev-master 746bce0           Symfony utilities for portability of PHP codes
symfony/routing              dev-master ad1dd8e           Symfony Routing Component
symfony/security-core        dev-master f4ca2ed           Symfony Security Component - Core Library
symfony/security-csrf        dev-master 46ad802           Symfony Security Component - CSRF Library
symfony/stopwatch            dev-master 13a61f2           Symfony Stopwatch Component
symfony/yaml                 dev-master bd17d50           Symfony Yaml Component

One of the main goals for Symfony 4 is to be as minimal as possible, so I don't know why these are installed:

• doctrine/cache
  (required by symfony/framework-bundle), see [FrameworkBundle] Remove dependency on Doctrine cache symfony#23131
• symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle), see [FrameworkBundle] remove Security deps from the require section symfony#22715
• symfony/polyfill-php56 (required by symfony/security-*)
• symfony/polyfill-php70 (required by symfony/security-csrf)
• symfony/polyfill-util (required by symfony/security-core and symfony/polyfill-php56)
• symfony/stopwatch (required by symfony/framework-bundle)
• symfony/class-loader (required by symfony/framework-bundle)
• paragonie/random_compat (required by symfony/polyfill-php70)

[fabpot]

I've done a lot of work in 3.3 to remove as many deps as possible. 3.4 will be the occasion to try removing some more, but I'm not sure we will be able to remove lots of them.

[fabpot]

symfony/polyfill-php56 and symfony/polyfill-php70 will be removed in Symfony 4.0 as the min PHP version will be PHP 7. That's 2 less deps for free.

[BPScott]

symfony/security-core depending on symfony/polyfill-util is bunk. So that's 4 off the list that will be removed when the minimum php version is bumped.

[stof]

And symfony/class-loader will be removed in 4.0 too, as the component is deprecated (it is used only by BC layers of FrameworkBundle)

[xabbuh]

paragonie/random-compat will also not be installed when the PHP 7.0 polyfill is not installed.

[xabbuh]

So, actually there's these four packages that could be looked into:

• doctrine/cache (required by symfony/framework-bundle)
• symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle)
• symfony/stopwatch (required by symfony/framework-bundle)

[stof]

@xabbuh is it symfony/security or symfony/security-core ? We should avoid dependencies on symfony/security as much as we can, as this is not the leaf of subtree splits (we should push other packages to depend on the actual security components they need btw).

symfony/stopwatch is here to register the profiling tool to build the timeline panel of the profiler (and yes, the profiler itself is part of HttpKernel and FrameworkBundle. WebProfilerBundle is only about the web UI allowing to read data from the profiler, not about collecting data).

Regarding doctrine/cache, I think it is related to the caching of annotations

[xabbuh]

No, it's symfony/security-core (I just copied the list from the issue description).

The Stopwatch IMO is not necessarily a hard requirement. Most of the times you will probably not use the profiler in production.

[stof]

But then, it means people would have to depend on it explicitly to benefit from this panel in the profiler. And we have to make the registration conditional (which is a BC break btw, as some bundles might expect that the service is there when FrameworkBundle is enabled)

[xabbuh]

Sure, but the same was already true for the other changes that we made to dependencies there.

[xabbuh]

looks like symfony/security-core and symfony/security-csrf are products of a bad merge (see symfony/symfony#22715) and we already removed them before (see symfony/symfony#20075)

[javiereguiluz]

@xabbuh I've just executed composer create-project symfony/skeleton:3.3.x-dev and the resulting dependencies are exactly the same. According to your comment, should the security dependencies be gone by now?

[stof]

@javiereguiluz yeah, the PR fixing the bad merge is not merged yet. this is why you still have it