Daniël Klabbers

Updating is a very lengthy process, we will explore new ways of reducing memory usage and process duration in the future. We already have some ideas how to do so,...

We could temporarily do this ourselves and PR against core to patch this.

I meant that bazaar should install packages without including dev dependencies by default. I wasn't specifically talking about installing bazaar 😁

It's not about dist mode, it's about dev mode: https://github.com/composer/composer/blob/master/src/Composer/Command/InstallCommand.php#L105

Oh that's what you said too, but doesn't composer set dev mode if left out.. Seems like it doesn't. We'd have to confirm this anyway.

So, never having heard of pointer based systems. The implementation would be like a salt. Whenever Bazaar calls on flagrow.io it would also send along the array of package names...

Thank you good point, I take it you're referencing [this line](https://github.com/flagrow/bazaar/blob/144f6b4b82853de498251309697a5979fc9185e7/src/Composer/Utils/ComposerFileEditor.php#L36) I see no other mention of `file_get_contents`.

Behind the scenes Bazaar uses the Composer package which uses file_get_contents [for pretty much](https://github.com/composer/composer/issues/4740) [everything](https://github.com/composer/composer/search?utf8=%E2%9C%93&q=file_get_contents&type=). I am not sure we can do anything about this without completely dropping the composer...

@Legoman99573 unless the shared host allows it for all sites. I can't imagine why you'd block it globally anyway..

I see some valid concerns, I also see several solutions. I'm not too sure crypto would make sense inside the current flow of app vs bazaar, especially related to paid...