Hi community, we are trying to clean up our production environments. per default "composer install"

U0121G9LVNC

Hi community,
we are trying to clean up our production environments. per default "composer install" is used to build for production. however this also installs dev dependencies which could lead to security issues.
Building the images with composer install --no-dev removes a whole bunch of dev dependencies. However these dependencies are required by the ShopApplication or Twig.
Is there a way to only use those plugins during development and NOT on production?
A good example is the WebProfiler https://documentation.spryker.com/docs/web-profiler-widget# which is required as a dev dependency but hardcoded in the application (see Screenshot 2, ShopApplicationDependencyProvider)

Valerii Trots

Hi Christian! I believe you are talking about project level implementation, so you can do whatever you want.
And even more, I checked and the situation you are talking about existed in demo shops v202001.0 - https://github.com/spryker-shop/b2b-demo-shop/blob/202001.0-p1/src/Pyz/Zed/Application/ApplicationDependencyProvider.php#L45.

But not any more in the current version - https://github.com/spryker-shop/b2b-demo-shop/blob/202009.0-p1/src/Pyz/Zed/Application/ApplicationDependencyProvider.php#L47.

U0121G9LVNC

Thanks for the quick answer! We will then use the approach of the new demo shop. We just didn`t want to invent something that may have already been fixed.

Unknown

In some cases, current core and project also exclude certain functionality based on environment, e.g. require-dev and dev only plugins or console commands:
APPLICATION_ENV === 'development'
Something similar could also work for you.