Consider removing package-command from the bundle #5925
Description
Given a wodpress project using composer to manage dependencies.
Running composer require wp-cli/wp-cli-bundle results in the following dependency tree:
composer show --tree wp-cli/wp-cli-bundle
wp-cli/wp-cli-bundle v2.10.0
├──wp-cli/cache-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/checksum-command ^2.1
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/config-command ^2.1
│ ├──wp-cli/wp-cli ^2.5
│ └──wp-cli/wp-config-transformer ^1.2.1
├──wp-cli/core-command ^2.1
│ ├──composer/semver ^1.4 || ^2 || ^3
│ └──wp-cli/wp-cli ^2.5.1
├──wp-cli/cron-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/db-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/embed-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/entity-command ^2
│ └──wp-cli/wp-cli ^2.10
├──wp-cli/eval-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/export-command ^2
│ ├──nb/oxymel ~0.1.0
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/extension-command ^2.1
│ ├──composer/semver ^1.4 || ^2 || ^3
│ └──wp-cli/wp-cli ^2.10
├──wp-cli/i18n-command ^2
│ ├──eftec/bladeone 3.52
│ ├──gettext/gettext ^4.8
│ │ ├──gettext/languages ^2.3
│ ├──mck89/peast ^1.13.11
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/import-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/language-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/maintenance-mode-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/media-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/package-command ^2.1
│ ├──composer/composer ^1.10.23 || ^2.2.17
│ │ ├──composer/ca-bundle ^1.0
│ │ ├──composer/class-map-generator ^1.0
│ │ │ ├──composer/pcre ^2.1 || ^3.1
│ │ │ └──symfony/finder ^4.4 || ^5.3 || ^6 || ^7
│ │ ├──composer/metadata-minifier ^1.0
│ │ ├──composer/pcre ^2.1 || ^3.1
│ │ ├──composer/semver ^3.2.5
│ │ ├──composer/spdx-licenses ^1.5.7
│ │ ├──composer/xdebug-handler ^2.0.2 || ^3.0.3
│ │ │ ├──composer/pcre ^1 || ^2 || ^3
│ │ │ └──psr/log ^1 || ^2 || ^3
│ │ ├──justinrainbow/json-schema ^5.2.11
│ │ ├──psr/log ^1.0 || ^2.0 || ^3.0
│ │ ├──react/promise ^2.8 || ^3
│ │ ├──seld/jsonlint ^1.4
│ │ ├──seld/phar-utils ^1.2
│ │ ├──seld/signal-handler ^2.0
│ │ ├──symfony/console ^5.4.11 || ^6.0.11 || ^7
│ │ │ ├──symfony/polyfill-mbstring ~1.0
│ │ │ ├──symfony/service-contracts ^2.5|^3
│ │ │ │ └──psr/container ^1.1|^2.0
│ │ │ └──symfony/string ^6.4|^7.0
│ │ │ ├──symfony/polyfill-ctype ~1.8
│ │ │ ├──symfony/polyfill-intl-grapheme ~1.0
│ │ │ ├──symfony/polyfill-intl-normalizer ~1.0
│ │ │ └──symfony/polyfill-mbstring ~1.0
│ │ ├──symfony/filesystem ^5.4 || ^6.0 || ^7
│ │ │ ├──symfony/polyfill-ctype ~1.8
│ │ │ └──symfony/polyfill-mbstring ~1.8
│ │ ├──symfony/finder ^5.4 || ^6.0 || ^7
│ │ ├──symfony/polyfill-php73 ^1.24
│ │ ├──symfony/polyfill-php80 ^1.24
│ │ ├──symfony/polyfill-php81 ^1.24
│ │ └──symfony/process ^5.4 || ^6.0 || ^7
│ └──wp-cli/wp-cli ^2.8
├──wp-cli/rewrite-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/role-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/scaffold-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/search-replace-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/server-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/shell-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/super-admin-command ^2
│ └──wp-cli/wp-cli ^2.5
├──wp-cli/widget-command ^2
│ └──wp-cli/wp-cli ^2.5
└──wp-cli/wp-cli ^2.10.0
├──mustache/mustache ^2.14.1
├──symfony/finder >2.7
├──wp-cli/mustangostang-spyc ^0.6.3
└──wp-cli/php-cli-tools ~0.11.2
That's 64 packages, 30 of which are wp-cli/* packages.
Of the remaining 34, 20 are only required by the wp-cli/package-command whose sole dependency outside of wp-cli/wp-cli is... composer/composer 🤨
From its documentation, the purpose of wp-cli/package-command is to manage globally installed wp-cli commands.
Why would someone installing wp-cli-bundle inside a project need/want a command to manage global wp-cli packages? Moreover, since said packages are just composer packages, why can't they just be installed with composer?
IMO, running composer require some/package should not end up installing composer inside the project's vendor directory.
It seems to me that the package command should be moved in the suggests section of the bundle's composer.json, and only included by default in the phar release.
And even then I highly doubt the usefulness of this command, so maybe it should just be deprecated then removed like the package index.
As a side note, removing this command would remove the largest source of dependency conflicts (see #5920, #5916, wp-cli/wp-cli-bundle#606, wp-cli/wp-cli-bundle#558, wp-cli/wp-cli-bundle#348, etc).