Phar bundles dev tooling, 78% of the binary

box.json sets exclude-dev-files: false, so the released phar bundles the full dev tree. In v5.3.0 that is 73.7MB of 94.6MB uncompressed: PHPStan, Pint, PHPUnit, Pest, Larastan and Paratest, none of which run at runtime.

It got noticeably worse in v5.3.0 (30MB to 44MB on disk) because #63 bumped larastan ^3.0 to ^3.11 and pint ^1.25 to ^1.30, which pulled in much larger PHPStan and Pint distributions. The cause is older than that PR though.

Worth excluding them from the build. Needs care: every runtime dependency lives in require-dev for this Laravel Zero app, so it has to be a targeted exclusion in box.json rather than composer install --no-dev.

Related: nothing rebuilds builds/ohdear automatically. It is committed and the release workflow uploads it as-is, so a dependency update does not reach users until someone rebuilds by hand. That is how v5.1.8, v5.2.0 and v5.2.1 all shipped a binary reporting 5.1.3. 9b032e0 added CI-side building and a352e5d reverted it 14 minutes later; might be worth another go.

Start with box.json and inspect how the committed builds/ohdear artifact is produced and uploaded by the release workflow. Verify which require-dev packages are excluded without removing runtime dependencies, then rebuild the binary and confirm the committed artifact is smaller and reflects the current dependency version.