Move wp-cli/package-command to require-dev #846

Copilot · 2026-01-15T23:00:58Z

Installing wp-cli/wp-cli-bundle via Composer currently pulls in 64 packages including composer/composer and 20+ transitive dependencies solely for wp-cli/package-command. This causes frequent dependency conflicts and bloats project installations with packages irrelevant to Composer-based workflows.

Changes

Moved wp-cli/package-command from require to require-dev
- Still available during development and CI builds
- Still bundled in Phar distributions (built with dev dependencies)
- Not installed when projects add wp-cli/wp-cli-bundle as a production dependency
Added suggestion in composer.json for users who need package management with Composer-based installations

Impact

Production installations: 64 → 38 packages (40% reduction)

Eliminates composer/composer dependency conflicts
Phar users: no change (package command remains available)
Composer users needing package management: explicit composer require wp-cli/package-command

// Before: wp-cli-bundle pulls in composer/composer + 20+ deps
"require": {
  "wp-cli/package-command": "^2.1"
}

// After: only included in dev/Phar builds
"require-dev": {
  "wp-cli/package-command": "^2.1"
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/composer/semver/zipball/38ccbbfd0098b205e4d947f18e3f1f321803b067
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/jsonrainbow/json-schema/zipball/2eeb75d21cf73211335888e7f5e6fd7440723ec7
- Triggering command: /usr/bin/php php /usr/local/bin/composer update --no-interaction (http block)
https://api.github.com/repos/wp-cli/ability-command/zipball/4f4a6caae780b20e9848c382dcb9114afbdc4c42
- Triggering command: /usr/bin/php php /usr/local/bin/composer update --no-interaction (http block)
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/block-command/zipball/7e738620e6ea79d4751086e65dfdfb038b7fb458
- Triggering command: /usr/bin/php php /usr/local/bin/composer update --no-interaction (http block)
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/cache-command/zipball/8d442986033c42d2c4fe768a85bbcc53673da814
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/checksum-command/zipball/6bd13cefb339ca06ab67ba4363d9b25206a25b63
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/config-command/zipball/1ac3a424e2fc8da4720c886f82986d0fcda80079
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/cron-command/zipball/a33beae28f75ed0dff001e0e007484e5b56512c7
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/db-command/zipball/bfb8ece6360ffd2057ea1a053e2b907f27af7b1e
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/embed-command/zipball/0d91f32e5552a3456e53e3ec766bd5c9d70e4210
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/entity-command/zipball/de8321842a50d6dc48f6d74150ce1e4930210673
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/eval-command/zipball/6176aec12987b97e22b097dcf9936df0bbb52937
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/export-command/zipball/d591284fde5889137e4b63a80c6b703580221c08
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/extension-command/zipball/7caff13b802e73316a96bf72c856b2ee960c4f05
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/i18n-command/zipball/48a61f49f3947d006d58359e29e5eed7c1e0a013
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/import-command/zipball/e5e6a36da26cfd6932ef9bbf37ae02bea533c4fb
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/language-command/zipball/b5905e9b28019f7355d1a4479a6d5dff83c1be1b
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/maintenance-mode-command/zipball/3e33d806a5000d0af04ada404ff4809a6cc0b841
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/media-command/zipball/08becd27f80edd032aa6e084602128df627f929a
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/php-cli-tools/zipball/833f9318a560b3b8d18e4b3230dd2d6894b016ad
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/rewrite-command/zipball/35c2f95e8e64eb4dc203532ef32d9e469339a720
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/role-command/zipball/198631678594d3d3ad77d9de74535f828814c8f8
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/search-replace-command/zipball/a1c38e459194ecfc085d200f5903afcd6876f555
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/server-command/zipball/90403ccc09be6d51c246bd559a3703b4c12e4d4f
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/shell-command/zipball/487b2032fe6e75f267e32d42fc0a256a0c6679a4
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/super-admin-command/zipball/a98215061b34580e999b099dba130c81319ee8ef
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/widget-command/zipball/70225d2eb334f7f0d012b38db1ce227a7d80b992
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/wp-cli/zipball/234a4e17c8329ddb6ac2d21ac8d2980ab9e139a6
- Triggering command: /usr/bin/php php /usr/local/bin/composer update --no-interaction (http block)
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/wp-cli/wp-config-transformer/zipball/5075ab7898c38bb608af9e5e18540131f507b2c8
- Triggering command: /usr/bin/php php /usr/local/bin/composer install --no-dev --no-interaction (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>Consider removing package-command from the bundle</issue_title>
<issue_description>Given a wodpress project using composer to manage dependencies.
Running composer require wp-cli/wp-cli-bundle results in the following dependency tree:

composer show --tree wp-cli/wp-cli-bundle

wp-cli/wp-cli-bundle v2.10.0
├──wp-cli/cache-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/checksum-command ^2.1
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/config-command ^2.1
│  ├──wp-cli/wp-cli ^2.5
│  └──wp-cli/wp-config-transformer ^1.2.1
├──wp-cli/core-command ^2.1
│  ├──composer/semver ^1.4 || ^2 || ^3
│  └──wp-cli/wp-cli ^2.5.1
├──wp-cli/cron-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/db-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/embed-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/entity-command ^2
│  └──wp-cli/wp-cli ^2.10
├──wp-cli/eval-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/export-command ^2
│  ├──nb/oxymel ~0.1.0
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/extension-command ^2.1
│  ├──composer/semver ^1.4 || ^2 || ^3
│  └──wp-cli/wp-cli ^2.10
├──wp-cli/i18n-command ^2
│  ├──eftec/bladeone 3.52
│  ├──gettext/gettext ^4.8
│  │  ├──gettext/languages ^2.3
│  ├──mck89/peast ^1.13.11
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/import-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/language-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/maintenance-mode-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/media-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/package-command ^2.1
│  ├──composer/composer ^1.10.23 || ^2.2.17
│  │  ├──composer/ca-bundle ^1.0
│  │  ├──composer/class-map-generator ^1.0
│  │  │  ├──composer/pcre ^2.1 || ^3.1
│  │  │  └──symfony/finder ^4.4 || ^5.3 || ^6 || ^7
│  │  ├──composer/metadata-minifier ^1.0
│  │  ├──composer/pcre ^2.1 || ^3.1
│  │  ├──composer/semver ^3.2.5
│  │  ├──composer/spdx-licenses ^1.5.7
│  │  ├──composer/xdebug-handler ^2.0.2 || ^3.0.3
│  │  │  ├──composer/pcre ^1 || ^2 || ^3
│  │  │  └──psr/log ^1 || ^2 || ^3
│  │  ├──justinrainbow/json-schema ^5.2.11
│  │  ├──psr/log ^1.0 || ^2.0 || ^3.0
│  │  ├──react/promise ^2.8 || ^3
│  │  ├──seld/jsonlint ^1.4
│  │  ├──seld/phar-utils ^1.2
│  │  ├──seld/signal-handler ^2.0
│  │  ├──symfony/console ^5.4.11 || ^6.0.11 || ^7
│  │  │  ├──symfony/polyfill-mbstring ~1.0
│  │  │  ├──symfony/service-contracts ^2.5|^3
│  │  │  │  └──psr/container ^1.1|^2.0
│  │  │  └──symfony/string ^6.4|^7.0
│  │  │     ├──symfony/polyfill-ctype ~1.8
│  │  │     ├──symfony/polyfill-intl-grapheme ~1.0
│  │  │     ├──symfony/polyfill-intl-normalizer ~1.0
│  │  │     └──symfony/polyfill-mbstring ~1.0
│  │  ├──symfony/filesystem ^5.4 || ^6.0 || ^7
│  │  │  ├──symfony/polyfill-ctype ~1.8
│  │  │  └──symfony/polyfill-mbstring ~1.8
│  │  ├──symfony/finder ^5.4 || ^6.0 || ^7
│  │  ├──symfony/polyfill-php73 ^1.24
│  │  ├──symfony/polyfill-php80 ^1.24
│  │  ├──symfony/polyfill-php81 ^1.24
│  │  └──symfony/process ^5.4 || ^6.0 || ^7
│  └──wp-cli/wp-cli ^2.8
├──wp-cli/rewrite-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/role-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/scaffold-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/search-replace-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/server-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/shell-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/super-admin-command ^2
│  └──wp-cli/wp-cli ^2.5
├──wp-cli/widget-command ^2
│  └──wp-cli/wp-cli ^2.5
└──wp-cli/wp-cli ^2.10.0
   ├──mustache/mustache ^2.14.1
   ├──symfony/finder >2.7
   ├──wp-cli/mustangostang-spyc ^0.6.3
   └──wp-cli/php-cli-tools ~0.11.2

That's 64 packages, 30 of which are wp-cli/* packages.
Of the remaining 34, 20 are only required by the wp-cli/package-command whose sole dependency outside of wp-cli/wp-cli is... composer/composer 🤨

From its documentation, the purpose of wp-cli/package-command is to manage globally installed wp-cli commands.

Why would someone installing wp-cli-bundle inside a project need/want a command to manage global wp-cli packages? Moreover, since said packages are just composer packages, why can't they just be installed with composer?

IMO, running composer require some/package should not end up installing composer inside the project's vendor directory.

It seems to me that the package command should be moved in the suggests section of the bundle's composer.json, and only included by default in the phar release.

And even then I highly doubt the usefulness of this command, so maybe it should just be deprecated then removed like the package index.

As a side note, removing this command would remove the largest source of dependency conflicts (see wp-cli/wp-cli#5920, wp-cli/wp-cli#5916, #606, #558, #348, etc).</issue_descript...

Fixes Consider removing package-command from the bundle wp-cli#5925

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

This change removes package-command and its 20+ dependencies (including composer/composer) from production installations while keeping it available for: - Phar builds (built with dev dependencies) - Development environments - Users who explicitly install it Reduces the dependency count from 64 to 38 packages when installing wp-cli-bundle in a project via Composer. Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Copilot

Pull request overview

This PR moves wp-cli/package-command from the require section to require-dev in composer.json to reduce production dependencies from 64 to 38 packages (40% reduction). The package command manages globally installed WP-CLI commands and has composer/composer as a dependency along with 20+ transitive dependencies, which causes frequent dependency conflicts for Composer-based installations. The command remains available in Phar builds (which are built with dev dependencies) and during development/CI.

Changes:

Moved wp-cli/package-command from require to require-dev
Added wp-cli/package-command to the suggest section with usage guidance

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-01-15T23:21:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Initial plan

5159d35

Copilot AI assigned Copilot and swissspidy Jan 15, 2026

Copilot started work on behalf of swissspidy January 15, 2026 23:01 View session

github-actions bot added enhancement New feature or request scope:framework labels Jan 15, 2026

Copilot AI changed the title ~~[WIP] Remove package-command from wp-cli bundle~~ Move wp-cli/package-command to require-dev Jan 15, 2026

Copilot AI requested a review from swissspidy January 15, 2026 23:10

Copilot finished work on behalf of swissspidy January 15, 2026 23:11

swissspidy requested a review from Copilot January 15, 2026 23:17

swissspidy added the scope:distribution label Jan 15, 2026

Copilot started reviewing on behalf of swissspidy January 15, 2026 23:18 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Move wp-cli/package-command to require-dev #846

Move wp-cli/package-command to require-dev #846

Uh oh!

Copilot AI commented Jan 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

codecov bot commented Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Move wp-cli/package-command to require-dev #846

Are you sure you want to change the base?

Move wp-cli/package-command to require-dev #846

Uh oh!

Conversation

Copilot AI commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Impact

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov bot commented Jan 15, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 15, 2026 •

edited

Loading