[Question] Remove more dependencies from new Symfony applications? #14

javiereguiluz · 2017-04-03T11:30:13Z

These are all the dependencies of a fresh Symfony app installed with Symfony Flex:

doctrine/cache               dev-master 0da649f           Caching library offering an object-oriented API for...
paragonie/random_compat      v2.0.10                      PHP 5.x polyfill for random_bytes() and random_int(...
psr/cache                    dev-master 78c5a01           Common interface for caching libraries
psr/container                dev-master b7ce3b1           Common Container Interface (PHP FIG PSR-11)
psr/log                      dev-master 4ebe3a8           Common interface for logging libraries
psr/simple-cache             dev-master 753fa59           Common interfaces for simple caching
symfony/cache                dev-master c9a100e           Symfony Cache component with PSR-6, PSR-16, and tags
symfony/class-loader         dev-master 2d60d55           Symfony ClassLoader Component
symfony/config               dev-master e068d79           Symfony Config Component
symfony/debug                dev-master 105f6a2           Symfony Debug Component
symfony/dependency-injection dev-master fab99da           Symfony DependencyInjection Component
symfony/dotenv               dev-master 56422dc           Registers environment variables from a .env file
symfony/event-dispatcher     dev-master 6813d5f           Symfony EventDispatcher Component
symfony/filesystem           dev-master 8de5137           Symfony Filesystem Component
symfony/finder               dev-master 851a876           Symfony Finder Component
symfony/flex                 dev-fix_configurator f7d1854
symfony/framework-bundle     dev-master ea46867           Symfony FrameworkBundle
symfony/http-foundation      dev-master 09aebc3           Symfony HttpFoundation Component
symfony/http-kernel          dev-master d95c776           Symfony HttpKernel Component
symfony/polyfill-mbstring    dev-master e79d363           Symfony polyfill for the Mbstring extension
symfony/polyfill-php56       dev-master 1dd42b9           Symfony polyfill backporting some PHP 5.6+ features...
symfony/polyfill-php70       dev-master 13ce343           Symfony polyfill backporting some PHP 7.0+ features...
symfony/polyfill-util        dev-master 746bce0           Symfony utilities for portability of PHP codes
symfony/routing              dev-master ad1dd8e           Symfony Routing Component
symfony/security-core        dev-master f4ca2ed           Symfony Security Component - Core Library
symfony/security-csrf        dev-master 46ad802           Symfony Security Component - CSRF Library
symfony/stopwatch            dev-master 13a61f2           Symfony Stopwatch Component
symfony/yaml                 dev-master bd17d50           Symfony Yaml Component

One of the main goals for Symfony 4 is to be as minimal as possible, so I don't know why these are installed:

doctrine/cache
(required by symfony/framework-bundle), see [FrameworkBundle] Remove dependency on Doctrine cache symfony#23131
symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle), see [FrameworkBundle] remove Security deps from the require section symfony#22715
symfony/polyfill-php56 (required by symfony/security-*)
symfony/polyfill-php70 (required by symfony/security-csrf)
symfony/polyfill-util (required by symfony/security-core and symfony/polyfill-php56)
symfony/stopwatch (required by symfony/framework-bundle)
symfony/class-loader (required by symfony/framework-bundle)
paragonie/random_compat (required by symfony/polyfill-php70)

The text was updated successfully, but these errors were encountered:

fabpot · 2017-04-03T22:29:03Z

I've done a lot of work in 3.3 to remove as many deps as possible. 3.4 will be the occasion to try removing some more, but I'm not sure we will be able to remove lots of them.

fabpot · 2017-04-05T02:03:04Z

symfony/polyfill-php56 and symfony/polyfill-php70 will be removed in Symfony 4.0 as the min PHP version will be PHP 7. That's 2 less deps for free.

BPScott · 2017-05-13T12:25:00Z

symfony/security-core depending on symfony/polyfill-util is bunk. So that's 4 off the list that will be removed when the minimum php version is bumped.

stof · 2017-05-15T08:57:53Z

And symfony/class-loader will be removed in 4.0 too, as the component is deprecated (it is used only by BC layers of FrameworkBundle)

xabbuh · 2017-05-15T09:58:59Z

paragonie/random-compat will also not be installed when the PHP 7.0 polyfill is not installed.

xabbuh · 2017-05-15T10:00:07Z

So, actually there's these four packages that could be looked into:

doctrine/cache (required by symfony/framework-bundle)
symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle)
symfony/stopwatch (required by symfony/framework-bundle)

stof · 2017-05-15T12:40:55Z

@xabbuh is it symfony/security or symfony/security-core ? We should avoid dependencies on symfony/security as much as we can, as this is not the leaf of subtree splits (we should push other packages to depend on the actual security components they need btw).

symfony/stopwatch is here to register the profiling tool to build the timeline panel of the profiler (and yes, the profiler itself is part of HttpKernel and FrameworkBundle. WebProfilerBundle is only about the web UI allowing to read data from the profiler, not about collecting data).

Regarding doctrine/cache, I think it is related to the caching of annotations

xabbuh · 2017-05-15T12:50:36Z

No, it's symfony/security-core (I just copied the list from the issue description).

The Stopwatch IMO is not necessarily a hard requirement. Most of the times you will probably not use the profiler in production.

stof · 2017-05-15T12:59:38Z

But then, it means people would have to depend on it explicitly to benefit from this panel in the profiler. And we have to make the registration conditional (which is a BC break btw, as some bundles might expect that the service is there when FrameworkBundle is enabled)

xabbuh · 2017-05-15T13:09:40Z

Sure, but the same was already true for the other changes that we made to dependencies there.

xabbuh · 2017-05-15T13:15:57Z

looks like symfony/security-core and symfony/security-csrf are products of a bad merge (see symfony/symfony#22715) and we already removed them before (see symfony/symfony#20075)

javiereguiluz · 2017-05-15T13:22:13Z

@xabbuh I've just executed composer create-project symfony/skeleton:3.3.x-dev and the resulting dependencies are exactly the same. According to your comment, should the security dependencies be gone by now?

stof · 2017-05-15T13:24:00Z

@javiereguiluz yeah, the PR fixing the bad merge is not merged yet. this is why you still have it

…ction (xabbuh) This PR was merged into the 3.2 branch. Discussion ---------- [FrameworkBundle] remove Security deps from the require section | Q | A | ------------- | --- | Branch? | 3.2 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | These requirements have been moved in #20075 before and are still present in the `require-dev` section. see symfony/flex#14 Commits ------- c690256 remove Security deps from the require section

xabbuh · 2017-06-12T14:41:04Z

see symfony/symfony#23131 and symfony/symfony#23148

fabpot · 2017-06-12T15:03:38Z

Closing this one as the two mentioned PRs on symfony/symfony removes the two remaining dependencies.

…(fabpot) This PR was squashed before being merged into the 3.4 branch (closes #23131). Discussion ---------- [FrameworkBundle] Remove dependency on Doctrine cache | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | yes | BC breaks? | yes | Deprecations? | yes | Tests pass? | yes | Fixed tickets | related to symfony/flex#14 | License | MIT | Doc PR | n/a In our quest to remove hard dependencies, I propose to remove `doctrine/cache` from the default dependencies on the Framework bundle. That's possible now as we have PSR6 cache support in Symfony and because Doctrine cache is only used for the validator mapping cache. The two other occurrences are for the serializer (already deprecated in 3.3) and for annotations, where we need to keep it, but as Doctrine annotations is already optional, that's not an issue. Commits ------- a4e336e [FrameworkBundle] removed doctrine/cache as a dependency b57895c [FrameworkBundle] deprecated validator.mapping.cache.doctrine.apc

…(fabpot) This PR was squashed before being merged into the 3.4 branch (closes #23131). Discussion ---------- [FrameworkBundle] Remove dependency on Doctrine cache | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | yes | BC breaks? | yes | Deprecations? | yes | Tests pass? | yes | Fixed tickets | related to symfony/flex#14 | License | MIT | Doc PR | n/a In our quest to remove hard dependencies, I propose to remove `doctrine/cache` from the default dependencies on the Framework bundle. That's possible now as we have PSR6 cache support in Symfony and because Doctrine cache is only used for the validator mapping cache. The two other occurrences are for the serializer (already deprecated in 3.3) and for annotations, where we need to keep it, but as Doctrine annotations is already optional, that's not an issue. Commits ------- a4e336ea34 [FrameworkBundle] removed doctrine/cache as a dependency b57895ccaf [FrameworkBundle] deprecated validator.mapping.cache.doctrine.apc

…h component (xabbuh) This PR was merged into the 3.4 branch. Discussion ---------- [FrameworkBundle] drop hard dependency on the Stopwatch component | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | no | BC breaks? | yes | Deprecations? | no | Tests pass? | yes | Fixed tickets | related to symfony/flex#14 | License | MIT | Doc PR | Commits ------- 8d70ca0 drop hard dependency on the Stopwatch component

…h component (xabbuh) This PR was merged into the 3.4 branch. Discussion ---------- [FrameworkBundle] drop hard dependency on the Stopwatch component | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | no | BC breaks? | yes | Deprecations? | no | Tests pass? | yes | Fixed tickets | related to symfony/flex#14 | License | MIT | Doc PR | Commits ------- 8d70ca0ff4 drop hard dependency on the Stopwatch component

fabpot · 2017-06-12T18:17:45Z

For the record, here are the deps installed when using Flex on Symfony 4.0:

psr/cache                    dev-master 78c5a01 Common interface for caching libraries
psr/container                dev-master b7ce3b1 Common Container Interface (PHP FIG PSR-11)
psr/log                      dev-master 4ebe3a8 Common interface for logging libraries
psr/simple-cache             dev-master 753fa59 Common interfaces for simple caching
symfony/cache                dev-master d33f0c2 Symfony Cache component with PSR-6, PSR-16, and tags
symfony/config               dev-master 0ab9fdc Symfony Config Component
symfony/debug                dev-master 2b1c9fd Symfony Debug Component
symfony/dependency-injection dev-master b0a214c Symfony DependencyInjection Component
symfony/dotenv               dev-master db3fc46 Registers environment variables from a .env file
symfony/event-dispatcher     dev-master 96440b5 Symfony EventDispatcher Component
symfony/filesystem           dev-master d3c60ec Symfony Filesystem Component
symfony/finder               dev-master d04fb01 Symfony Finder Component
symfony/flex                 dev-master 40802c3
symfony/framework-bundle     dev-master 862a108 Symfony FrameworkBundle
symfony/http-foundation      dev-master a823a2f Symfony HttpFoundation Component
symfony/http-kernel          dev-master ae2ad6d Symfony HttpKernel Component
symfony/polyfill-mbstring    dev-master f29dca3 Symfony polyfill for the Mbstring extension
symfony/routing              dev-master 5b8196a Symfony Routing Component
symfony/yaml                 dev-master 2a18a53 Symfony Yaml Component

Pierstoval · 2017-06-13T08:22:20Z

From 28 to 19, nice! 👏

…luz) This PR was merged into the master branch. Discussion ---------- Proposed "logger" as an alias of Monolog Commits ------- 5da6d51 Proposed "loggers" as an alias of Monolog

fabpot mentioned this issue Apr 3, 2017

[Question] Is the auto port detection lost in Symfony Flex? #16

Closed

xabbuh mentioned this issue May 15, 2017

[FrameworkBundle] remove Security deps from the require section symfony/symfony#22715

Merged

xabbuh mentioned this issue Jun 12, 2017

[FrameworkBundle] drop hard dependency on the Stopwatch component symfony/symfony#23148

Merged

fabpot mentioned this issue Jun 12, 2017

[FrameworkBundle] Remove dependency on Doctrine cache symfony/symfony#23131

Merged

fabpot closed this as completed Jun 12, 2017

glensc mentioned this issue Dec 19, 2018

Require PHP 7.1+ at runtime eventum/eventum#426

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[Question] Remove more dependencies from new Symfony applications? #14

[Question] Remove more dependencies from new Symfony applications? #14

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

[Question] Remove more dependencies from new Symfony applications? #14

[Question] Remove more dependencies from new Symfony applications? #14

Comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!