Make webpack-dev-server optional

[Kocal]

As discussed with @stof, we want to make the webpack-dev-server an optional peer dependency:

JavaScript dependencies are problematic, depending on many sub-dependencies, which in turn depend on more sub-dependencies, and so on... Welcome to the dependency hell!

Even if the dev-server functionality isn't used, the dependency tree is immensely more complex (over 300 additional dependencies), but this is an open door to security holes present in “discrete” (say “little-known”), but over-used dependencies.

In recent months, a sort of “witch-hunt” has been set up by some people in the JavaScript ecosystem, to replace sub-dependencies with lighter alternatives (either another dependency, or a native version) in popular project. I've started doing this on Encore for a few dependencies, and making the webpack-dev-server optional is a big win.

Package size report
===================

Package info for "@symfony/[email protected]": 61 MB
  Released: 2024-08-29 16:26:01.762 +0000 UTC (1w3d ago)
  Downloads last week: 19,232 (11.57%)
  Estimated traffic last week: 1.2 TB
  Subdependencies: 626

Removed dependencies:
  - [email protected]: 29 MB (47.60%)
    Downloads last week: 2,605,016 (N/A% from 4.15.2)
    Downloads last week from "@symfony/[email protected]": 19,232 (N/A%)
    Traffic last week: N/A
    Traffic from "@symfony/[email protected]": 1.2 TB (N/A%)
    Subdependencies: 283 (45.20%)

Estimated new statistics:
  Package size: 61 MB → 43 MB (69.83%)
  Subdependencies: 626 → 295 (-331)
  Traffic with last week's downloads:
    For current version: 1.2 TB → 823 GB (355 GB saved)
    For all versions: 10 TB → 7.1 TB (3.1 TB saved)

When upgrading Encore to v5, end-users will have to install the webpack-dev-server back to use it again.

[Kocal]

I could have used isPackageInstalled(), but I would have to rewrite a lot of logic here to enforce the version, generate the good command, etc...

Adding method parameter to featuresHelper.ensurePackagesExistAndAreCorrectVersion was a lot easier and clean.

[stof]

types relying on import('webpack-dev-server').Configuration need to be changed to use object instead, as our type declarations cannot depend on optional dependencies

[Kocal]

types relying on import('webpack-dev-server').Configuration need to be changed to use object instead, as our type declarations cannot depend on optional dependencies

You think so? I kept webpack-dev-server as a dev dependency, and it looks like fine

[stof]

@Kocal as long as we use types for ourselves, the dev dependency is indeed enough. But this would block #816 which was the primary reason to add more precise types. Types shipped in the package cannot use dev dependencies.

[Kocal]

Ah, I didn't think about that, I will change that, thanks

[Kocal]

Checks are finally green.