Composer dependencies

[ossinkine]

Many packages are missing dependencies in composer.json. For example, Zend\Authentication\Validator\Authentication uses Zend\Stdlib\ArrayUtils and Zend\Validator\AbstractValidator, Zend\ModuleManager\Listener\ServiceListener uses Zend\ServiceManager\*. There are a few more examples.
You simply "forgot" to add them or is there a principle by which packages get into composer.json?
By what principle they fall into the require, require-dev and suggest?

[weierophinney]

This is a story I'm working on for 2.3 -- to go through all dependencies and make sure we have them properly in both the "require" and "suggest" headings.

There are many cases where the default implementation uses a specific component -- but usage of that component is not actually required (there are ways to consume the component without it). In such cases, the dependency should be marked as "suggest". "require" should really only happen if the component cannot work at all without the dependency.

In terms of "require-dev", usually anything in "suggest" will be added to "require-dev" so that we can test the various bits of functionality, which usually means testing even optional dependencies.

[weierophinney]

And yes, there are also cases where we simply missed some dependencies when creating the composer.json.

[marc-mabe]

@weierophinney It would be great if each component runs tests with an own composer install on travis but this would also slow down thinks. Doesn't it?

[ossinkine]

If each class of Package1 required classes from Package2, then Package1 requires Package2, if only certain classes of Package1 required classes from Package2, then Package1 suggest Package2. Right?
It can be done automatically, I'll do it.

[ossinkine]

Changes are made semi-automatically using the tool https://github.com/ossinkine/composer-dependency-fixer
The tool still raw, but to do this it is enough.
Existing packages in comoposer.json are not affected. Added used packages in "require-dev" and "suggest" sections.