Repository navigation
Phar bundles dev tooling, 78% of the binary #64
Description
box.json sets exclude-dev-files: false, so the released phar bundles the full dev tree. In v5.3.0 that is 73.7MB of 94.6MB uncompressed: PHPStan, Pint, PHPUnit, Pest, Larastan and Paratest, none of which run at runtime.
It got noticeably worse in v5.3.0 (30MB to 44MB on disk) because #63 bumped larastan ^3.0 to ^3.11 and pint ^1.25 to ^1.30, which pulled in much larger PHPStan and Pint distributions. The cause is older than that PR though.
Worth excluding them from the build. Needs care: every runtime dependency lives in require-dev for this Laravel Zero app, so it has to be a targeted exclusion in box.json rather than composer install --no-dev.
Related: nothing rebuilds builds/ohdear automatically. It is committed and the release workflow uploads it as-is, so a dependency update does not reach users until someone rebuilds by hand. That is how v5.1.8, v5.2.0 and v5.2.1 all shipped a binary reporting 5.1.3. 9b032e0 added CI-side building and a352e5d reverted it 14 minutes later; might be worth another go.
Activity
owenvoke commentedon Sep 7, 2026
This is generally why PHPStan and similar tools have a
*-srcrepository. That could resolve this issue, as we'd then be able to have the dependencies in the right locations.(i.e. have an
ohdear-cli-srcrepository, that has the contents of this repo, and thenohdear-cliwould just have acomposer.jsonand the compiled binary – and I guess maybe the skill)