Detect bref/secrets-loader installed as dependency of another package

[kevincerro]

If you require bref/secrets-loader in another package as dependency you get this warning on serverless cli

With this simple change we detect if bref/secrets-loader is really installed, as direct dependency or as a dependency of another package.

[GrahamCampbell]

Not sure we should allow transitive dependencies, as this can be risky. We should force applications to explicitly require it.

[mnapoli]

I agree with @GrahamCampbell, it's usually a best practice to explicitly require your direct dependencies.

Do you have a specific use case here? (I'm curious how the package is installed via another dependency, is it an internal package?)

[kevincerro]

I agree with @GrahamCampbell, it's usually a best practice to explicitly require your direct dependencies.

Do you have a specific use case here? (I'm curious how the package is installed via another dependency, is it an internal package?)

Yes, I made an internal php package for a laravel-based php framework to autoconfigure it for serverless using bref. I wanted to change less as possible the core, so creating an internal php package with all the needed was the way to go.

[mnapoli]

Makes sense.

The diff is very minimal and technically makes sense, I'm fine merging. Can you confirm you tested this and it works? (it's not covered by tests IIRC)

[kevincerro]

Makes sense.

The diff is very minimal and technically makes sense, I'm fine merging. Can you confirm you tested this and it works? (it's not covered by tests IIRC)

Yes, its working, warning is gone.

Before

After

[mnapoli]

Thanks!