Move "yiisoft/yii2-debug" to developments dependencies

[edgardmessias]

Move "yiisoft/yii2-debug" to developments dependencies

From:

    "require": {
        ...
        "yiisoft/yii2-debug": "^2.0",
        ...
    },
    "require-dev": {
        "hiqdev/hidev-php": "<2.0",
        "hiqdev/hidev-hiqdev": "<2.0"
    },

To:

    "require": {
        ...
    },
    "require-dev": {
        "hiqdev/hidev-php": "<2.0",
        "hiqdev/hidev-hiqdev": "<2.0",
        "yiisoft/yii2-debug": "^2.0"
    },

[hiqsol]

Actually this is on purpose. But I'll think about it.

[edgardmessias]

This in production is not necessary

[hiqsol]

require-dev is not about dev environment.

And actually I prefer to have yii2-debug in production.

[alexantr]

yii2-debug not for production. And official Yii project templates use this extension in require-dev section.

[cebe]

And actually I prefer to have yii2-debug in production.

yii2-debug is not made for use in production and may introduce security issues if enabled.

[hiqsol]

Is properly set allowedIps enough to be safe? If it is not could you please provide more info?

[samdark]

Yes. Setting up allowed IPs should be secure enough. It is require-dev section for two reasons:

1. Performance. When debug is enabled, info is collected and it takes extra time to do it.
2. Security. If misconfigured, presence of debug panel exposes everything. You can check google to see how many projects in production are, in fact, misconfigured.