Required Packages Are Extremely Bloated

[mattholwood]

Adding this package to my project increased its deployment size by 5x. That is totally unacceptable. Every step should be taken to reduce the number of dependencies. There's a real world need for third party libraries to be audited and packages like 'KellermanSoftware' are completely superfluous.

[SerKnight]

Hi @mattholwood - I agree. The current size is not reasonable. We've had some team churn around support for this so larger refactors like these have been put on hold. I think using this issue to start to strategize how to reduce the pkg size is a good idea.

This conversation is going on across the SDK's - one idea is to split out the functionality to not include API sets you don't need, because most devs mainly use the accounting API sets (compared to nz payroll functions).

Let me know if you have other ideas and we will start to scope the work. Can you point to the KellermanSoftware dependency specifically?

[mattholwood]

Hey Ser,

The KellermanSoftware.CompareNETObjects dependency rests entirely on this line: https://github.com/XeroAPI/Xero-NetStandard/blob/cde93c768cf4c08796d445a3f82ba326ea9bc53a/Xero.NetStandard.OAuth2/Client/ClientUtils.cs#L193

The JsonSubTypes package can be removed from Xero.NetStandard.OAuth2. As far as I can tell it's not used.

The Xero.NetStandard.OAuth2Client nuget package has some unneeded required dependencies too:

• System.Net.Http.Json
• System.IdentityModel.Tokens.Jwt

Thankfully everything is open source and I've been able to include the source files in our project and remove a lot of the junk.

Hopefully this helps! Sorry I don't have time to submit a pull request.

[mattholwood]

Using only githubs reference check so please take with a grain of salt, the following line which causes the reference to KellermanSoftware.CompareNETObjects is really poor form. The entire Deserialize method should be scrapped, a generic will be much better also :) https://github.com/XeroAPI/Xero-NetStandard/blob/cde93c768cf4c08796d445a3f82ba326ea9bc53a/Xero.NetStandard.OAuth2/Client/ApiClient.cs#L168

[DevelopmentDan]

I agree. I was dismayed to install the Xero.NetStandard.OAuth2 and Xero.NetStandard.OAuth2Client into my project only to have the following list of packages installed with them. Is there any change at all of getting this under control - perhaps even to a no dependency position?:

IdentityModel -- Newtonsoft.Json -- System.Text.Encodings.Web System.IdentityModel.Tokens.Jwt System.Net.Http.Json -- System.Text.Json ----Microsoft.Bcl.AsyncInterfaces ----System.Buffers ----System.Memory ----System.Numeric.Vectors ----System.Runtime.ComplilerServices.Unsafe ----System.Text.Encodings.Web ----System.Threading.Task.Extensions ----System.ValueTuple CompareNETObjects JsonSubTypes -- Newtonsoft.Json Newtonsoft.Json RestSharp System.ComponentModel.Annontations

And probably a few more - I've lost track!

[r-work]

I just came here to open an issue for replacing Newtonsoft.Json with System.Text.Json. And then I saw this issue 🙂