[policy, no patch] How to deprecate unused dependencies

Problem/Motivation

Drupal core relies on external dependencies. Sometimes we no longer need a specific dependency for core purposes. The reason we cannot remove the dependencies when they become obsolete for the core itself is that contributed projects or customizations might still depend on those. Instead, we need to have a process to mark them as deprecated so that they could be removed in the next major release.

We should take into account various aspects of the problem since we have various kinds of dependencies. Not all of our dependencies are downloaded through package management systems like composer or npm. We have dependencies in both, PHP and JavaScript and they are being used differently. Not all of the dependencies are exposed as services or asset libraries.

Proposed resolution

Core dependency release cycles →

current text

N/A

proposed text

new section

Remove dependency

Unused dependency

• A change notice is published when removing a dependency that is no longer used. The change notice should make recommendation for contributed or custom code using that dependency
• Unused dependencies will be deprecated when possible.

-- original proposal ---

• Dependencies not exposed as services or asset libraries and loaded through a package manager can be removed. If a contributed project or custom module depends on that, they should have documented their dependency to their package manager configuration.
• Dependencies exposed as services or asset libraries (loaded through a package manager or not) cannot be removed but will be marked as deprecated. Provide a new feature that allows marking asset libraries and services as deprecated once they are no longer needed which would trigger a deprecation error if used.

Remaining tasks