Repository navigation
[Pkg] Move the tooling devDependencies of the packages to the root package.json - #4156
Merged
Merged
Conversation
Kocal
force-pushed
the
move-tooling-dev-dependencies-to-root
branch
from
October 27, 2026 09:13
bcb840c to
cbe1ffb
Compare
Kocal
added a commit
that referenced
this pull request
Oct 27, 2026
| Q | A | -------------- | --- | Bug fix? | yes | New feature? | no | Deprecations? | no | Documentation? | no | Issues | | License | MIT A bridge's `vendor/` links back to its package through the Composer path repository (for example `src/Image/src/Bridge/Cloudflare/vendor/symfony/ux-image` points to `src/Image`). When that `vendor/` exists, the PHPUnit run of the package follows the link while it scans `src/` for its `<source>` configuration, and never ends. Now that the CI only runs the affected packages, a package and its bridges can start in the same batch. The PHP jobs of #4156 hung for 40 minutes on `src/Image` because of this. The bridges now start once every other package is done. This adds about 7 seconds to each PHP job, which is the time the bridges take.
Kocal
added a commit
that referenced
this pull request
Oct 27, 2026
…e (Kocal) This PR was merged into the 3.x branch. Discussion ---------- [CI] Run the tests of the bridges once their package is done | Q | A | -------------- | --- | Bug fix? | yes | New feature? | no | Deprecations? | no | Documentation? | no | Issues | | License | MIT A bridge's `vendor/` links back to its package through the Composer path repository (for example `src/Image/src/Bridge/Cloudflare/vendor/symfony/ux-image` points to `src/Image`). When that `vendor/` exists, the PHPUnit run of the package follows the link while it scans `src/` for its `<source>` configuration, and never ends. Now that the CI only runs the affected packages, a package and its bridges can start in the same batch. The PHP jobs of #4156 hung for 40 minutes on `src/Image` because of this. The bridges now start once every other package is done. This adds about 7 seconds to each PHP job, which is the time the bridges take. Happened in https://github.com/symfony/ux/actions/runs/40479128905/job/122123495567?pr=4156 Commits ------- 596d3b6 [CI] Run the tests of the bridges once their package is done
| Q | A | -------------- | --- | Bug fix? | yes | New feature? | no | Deprecations? | no | Documentation? | no | Issues | Fix symfony#4152 | License | MIT The Flex recipes install a UX package with `"file:vendor/symfony/ux-*/assets"`, and npm also installs the `devDependencies` of that directory. Applications ended up with the test tooling of each package (vitest, vite, jsdom, typescript, `@testing-library/*`) in their lockfile, and their vulnerability scanners reported its advisories. Every devDependency that is not also a peerDependency now lives in the root `package.json`: the tooling, the `@types/*` packages and `idiomorph`, which the build bundles into `dist/` anyway. A package only repeats its peerDependencies, so an application only gets the peers it already needs. A new step of the `validate-packages` CI job fails when a package lists a devDependency that is not a peerDependency of the exact same version. Lockfile entries of an app that installs one package through `file:`: | Package | Before | After | | --- | --- | --- | | `@symfony/ux-live-component` | 157 | 4 | | `@symfony/ux-autocomplete` | 131 | 7 | | `@symfony/ux-react` | 135 | 7 | | `@symfony/ux-vue` | 147 | 27 | | All 19 packages | 1860 | 116 |
Kocal
force-pushed
the
move-tooling-dev-dependencies-to-root
branch
from
October 27, 2026 10:42
cbe1ffb to
cea6185
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Flex recipes install a UX package with
"file:vendor/symfony/ux-*/assets", and npm also installs thedevDependenciesof that directory. Applications ended up with the test tooling of each package (vitest, vite, jsdom, typescript,@testing-library/*) in their lockfile, and their vulnerability scanners reported its advisories.This PR moves the tooling dependencies that Dependabot updates to the root
package.json. The packages keep their peer dependencies, the types of their peers, andidiomorph, which is bundled intodist/.A test in
bin/now fails when a package declares a tooling dependency again, and Dependabot only watches the root directory.Lockfile entries of an app that installs one package through
file::@symfony/ux-live-component@symfony/ux-autocomplete@symfony/ux-react@symfony/ux-vue