composer.json hard-requires drupal/message and drupal/message_notify, though only the optional private_message_notify submodule uses them

Problem/Motivation

In 3.0.7, the project's composer.json declares both drupal/message and drupal/message_notify as hard requirements:

"require": {
    "php":  >=8.1",
    "drupal/message": "^1.0",
    "drupal/message_notify": "^1.0"
}

As far as I can tell, neither is needed by the main module:

• private_message.info.yml declares only drupal:text — it does not require any other contributed module to be enabled.
• The only place either package is needed is the optional private_message_notify submodule, whose private_message_notify.info.yml declares message_notify:message_notify.
• 3.x removed the private_message.notifier service and the Message-entity notification model altogether, replacing them with hook_private_message_new_message(). So the main module has no remaining caller for either package.

On top of that, the drupal/message line looks redundant even for the submodule's sake: drupal/message_notify already requires drupal/message: ^1.0 itself, so it would be pulled in transitively anyway.

If this list is produced by the Drupal.org packaging script folding submodule dependencies into the parent package, that would explain how it got there — in which case the question is whether that outcome is intended, rather than whether the file is wrong.

Practical effect

Sites that use private messaging without the notify submodule still get two extra contributed projects installed and carried through every update, with no code path using them. In our case we route notifications through our own system and have never enabled private_message_notify, yet both packages remain in vendor/ after uninstalling the modules at the Drupal level.

It is a cosmetic problem rather than a functional one — nothing breaks — but it does make dependency review harder, and it is surprising when a module's own .info.yml requires nothing while its composer.json requires two projects.

Prior discussion

#2980026 proposed removing composer.json entirely and was closed as works as designed, with the note that the file is "required, due to various dependencies". That was accurate for 2.x, where the main module genuinely consumed message_notify through private_message.notifier. Since 3.x dropped that service, I think the situation is materially different — hence a fresh issue rather than reopening that one.

Questions for the maintainers

1. Is the current require block intentional — for example, to keep the notify submodule installable without extra steps?
2. If it is a side effect of submodule dependency folding, is that something you would want to change?
3. Would you be open to moving these to suggest, or to splitting private_message_notify into its own project (as was already done for private_message_flood_protection and private_message_nodejs)?
4. At minimum, would dropping the redundant drupal/message line be acceptable, given drupal/message_notify already requires it?

Happy to provide a merge request for whichever direction you prefer. I am not proposing a behaviour change — only asking whether the dependency declaration still reflects what 3.x actually needs.

Steps to reproduce

1. composer require drupal/private_message:3.0.7 on a site that will not enable private_message_notify.
2. Observe that drupal/message and drupal/message_notify are installed.
3. Enable only private_message; note that neither of the other two modules needs to be enabled for it to work.
4. Uninstall message and message_notify in Drupal; note the packages remain in vendor/ and are reinstalled on every composer install.

Environment

Drupal 10, private_message 3.0.7, message 1.8.0, message_notify 1.5.0.

Claude Opus 5 was used to assist with investigation of my finding, then for composing the title and description of the ticket.