Closed kevincerro closed 10 months ago
Not sure we should allow transitive dependencies, as this can be risky. We should force applications to explicitly require it.
I agree with @GrahamCampbell, it's usually a best practice to explicitly require your direct dependencies.
Do you have a specific use case here? (I'm curious how the package is installed via another dependency, is it an internal package?)
I agree with @GrahamCampbell, it's usually a best practice to explicitly require your direct dependencies.
Do you have a specific use case here? (I'm curious how the package is installed via another dependency, is it an internal package?)
Yes, I made an internal php package for a laravel-based php framework to autoconfigure it for serverless using bref. I wanted to change less as possible the core, so creating an internal php package with all the needed was the way to go.
Makes sense.
The diff is very minimal and technically makes sense, I'm fine merging. Can you confirm you tested this and it works? (it's not covered by tests IIRC)
Makes sense.
The diff is very minimal and technically makes sense, I'm fine merging. Can you confirm you tested this and it works? (it's not covered by tests IIRC)
Yes, its working, warning is gone.
Thanks!
If you require![Captura de pantalla 2023-10-22 a las 13 54 20](https://github.com/brefphp/bref/assets/13980708/a7b292c5-e845-4075-8611-4a5742b6744a)
bref/secrets-loader
in another package as dependency you get this warning on serverless cliWith this simple change we detect if
bref/secrets-loader
is really installed, as direct dependency or as a dependency of another package.