Core dependency evaluation criteria

Criteria for adding dependencies

Any dependency proposed for Drupal core should be evaluated for the following criteria:

1. Maintainership of the package
2. Security policies of the package
3. Expected release and support cycles
4. Code quality
5. Other dependencies it would add, if any (the full tree, not just direct dependencies), and evaluations for those dependencies as well

The above information should be added to the issue summary under its own semantic header.

All new dependencies require sign-off from both framework and release managers so add the tags 'Needs Needs framework manager review" and "Needs release manager review" to the issue.

When considering the addition of a dependency the following points are considered.

• How well the dependency fits Drupal's need.
• If the value added by the dependency justifies the additional maintenance
• If the value added by the dependency justifies the security risks

Refer to #3352389: Add open-telemetry/sdk and open-telemetry/exporter-otlp as dev dependencies for an example.

Dependency information links

It is important to know information such as who to contact in a dependency project, it's release cycle and how to file an issue for the dependency. This type information may be provided by the package meta data but not always. Therefore we have two methods to find that data.

1. For dependencies that have a large security or API surface, the information is added in either Current JavaScript dependencies and Current PHP dependencies. Other dependencies may be added at the discretion of the release managers.
2. For all other dependencies the information should be in the issue summary, so the special tag, "approved dependency evaluation" added when the issue is Fixed. See issues tagged "approved dependency evaluation".

The information in either Current JavaScript dependencies and Current PHP dependencies can be updated at any time. It should be updated in the following situations; 

• When a dependency is added, add a new listing
• When a dependency is deprecated, update the listing to include that it is to be remove in the next major version.
• When the last Drupal version to require it reaches End of Life (EOL), remove the listing.