@Reedy I don't think there are any relevant dependencies.

css-sanitizer

The item in the check list is vague. Yes it’s already in master, but it’s not currently included in release branches

css-sanititer is a Composer dependency. I thought those get packaged automatically in the bundle?

In T327006#8526678, @Tgr wrote:

css-sanititer is a Composer dependency. I thought those get packaged automatically in the bundle?

Automatically, as far as what is in the vendor branch (submoduled into the REL1_XX branch) is included. And the REL1_XX branch of vendor is made by (manually, because the tracking of dependancies is hard) trimming the master branch.

Like I say, "Any relevant dependencies also bundled" is vague... It could cover dependant skins/extensions, composer libraries etc.

Bundled would suggest currently included etc. Whereas it's not currently, so it is not currently bundled. It can be (trivially) bundled in future.

I know, it's semantics.

Why aren't we just using composer install? There's a security disadvantage in theory, but the moment you install any other extension you'll get vendor code generated by Composer anyway...

In any case, what's the actionable part? The trimming will only happen when REL1_40 is cut, right? Should a notice be added somewhere about css-sanitizer now being a bundle dependency?

(manually, because the tracking of dependancies is hard)

I tried to add more formal tracking at one point but it didn't garner much interest.

In T327006#8526704, @Tgr wrote:

Why aren't we just using composer install? There's a security disadvantage in theory, but the moment you install any other extension you'll get vendor code generated by Composer anyway...

We'd have to setup/use composer merge plugin for that to work. As it'd need to know about the core + any skin/extension dependancies...

But then we also lose the pinning of individual packages like we do. As in the composer.json in MW Core, we don't pin every individual and dependant package like we (or at least try to) do in Vendor

In T327006#8526704, @Tgr wrote:

In any case, what's the actionable part? The trimming will only happen when REL1_40 is cut, right? Should a notice be added somewhere about css-sanitizer now being a bundle dependency?

It's part of the bigger issue (as below). It's not uncommon we miss (or leave something extra) in vendor when we do the manual trimming.

In T327006#8526704, @Tgr wrote:

(manually, because the tracking of dependancies is hard)

I tried to add more formal tracking at one point but it didn't garner much interest.

I know :). But just pointing out (for others watching too) how awkward this kinda gets.

Yes, this is all very rough around the edges.

And like I say, what "Any relevant dependencies also bundled" actually means is vague at best.