chore: move rector from require-dev to require

[kenjis]

Description
See #111 (comment)

Checklist:

• Securely signed commits
• [] Component(s) with PHPDoc blocks, only if necessary or adds value
• [] Unit testing, with >80% coverage
• [] User guide updated
• [] Conforms to style guide

[MGatner]

A consideration: since DevKit is available for anyone to use, do we want to be locking the Rector version? If we do, we end up managing this repo and could bottleneck other people's upgrades. If we don't, we would need to lock it in our own repos to whatever config we are using.

[MGatner]

@samsonasik opinion as well

[samsonasik]

Looks good

[kenjis]

@MGatner @samsonasik Ah, we cannot lock the version in this repo?
If we do, other people who use this cannot upgrade their rector version.

If we don't, we would need to lock it in our own repos to whatever config we are using.

Yes.

[kenjis]

After all, since rector is not yet stable, the best practice is for each project to lock in a version. Otherwise, rector.php may stop working.

If we lock the version in this repository, and even if we constantly update to the latest version, rector.php in the user's repository will not be automatically updated, which could cause rector to stop working.

I'm starting to feel like we should leave require-dev as it is.

[samsonasik]

pin rector to specific version is fine, on laminas, we are doing that, see

https://github.com/laminas/laminas-servicemanager-migration/blob/cdedb23f9df8480daead4dbef79b35f26fedcc86/composer.json#L19

[samsonasik]

When new rector released, pin version need to be updated (or not if cause error),

If pin updated, then create new release of dev kit

[datamweb]

If pin updated, then create new release of dev kit

last release of dev Dec 22, 2022 but rector new version every week:smiley:. dev cannot act like reactor.

[MGatner]

Right. I don't want us to be managing releases here just around Rector. My opinion: we include Rector with ^ and let devs handle their own version locking (or not). Most of my smaller repo projects run fine between Rector patches and aren't worth locking to a specific version - I just go fix them when Dependabot breaks a pipeline (e.g. deprecated rule).

[kenjis]

@MGatner I changed to ^0.18.3.

[kenjis]

I think we can release a new devkit after merging this PR.