this block is the main and only behavior change of this PR (same on YamlFileLoader)

I would say:Move your child definitions to a different file or define this attribute explicitly.

updated (and test case added)

it would be great to be able to change this service to become private in 4.0 (as event listeners can now be private).
@nicolas-grekas I thnk a necessary feature for 3.4 would be a way to mark a service as "wanna-be-private", which would trigger a deprecation warning when getting it from the container throughget, but not when injecting it inside another service (unlike deprecated services). Such feature would allow any bundle out there to provide gradual migration to private services (warning people if they try to access internal services that will become private)

100% agree, and this PR is on that path :)
No need for any new feature as there is already a trick to do the deprecation, see:

no, the form types are deprecating the services entirely, because they won't be needed anymore in 4.0 (form types without any dependencies don't need to be registered explicitly anymore).

But we might have a case where we want to deprecate the runtime retrieval of services (to make them private) without deprecating the service itself (as you will want to keep it as a dependency of other services), which is what we need for listeners.

And making them public in a deprecated manner works for Symfony services in 3.4.x. but it does not work for the future of Symfony, because your proposal relies on the BC layer for accessing non-inlined private services. But Symfony 4 will not make such services public at all, even when not inlined, and so you cannot have a similar BC layer for the migration to private services.

Btw, if you want to be sure that the services stay public, you must create 2 dummy registries. If you create only one, the service may end up being inlined inside the dummy registry if other references get removed by some optimizations.

The form types I linked are the ones that are not deprecated because they need special instantiation.
You're right that this trick is valid only on 3.4. But maybe 3.4 is the last one that will have public services? So if using the trick is enough for 3.4, then maybe better not to work on a new feature for nothing?

Anyway, that's an interesting discussion, but should not be hidden in this PR :)

shouldn't it be a normal requirement ? The bundle is all about defining services anyway.

In fact, DebugBundle can and is used standalone on Silex, see
https://packagist.org/packages/jeromemacias/silex-debug

hmm indeed, they get it to get the template for the profiler, which is not in WebProfilerBundle unlike other collectors

@nicolas-grekas this autowiring alias should point toannotation_reader, which is the public name for it (even though it is an alias), so that people decorating the public name still get it applied in case of autowiring.

this changes the visibility of this collector. Is it expected ?

yes, the service does not need to be public

As we have a requirement on it, just update the lower bound of the requirement. It is more efficient in the composer solver than adding a conflict rule.

update the requirement lower bound instead