symfony/security-csrf is installable as a stand-alone package. However, it requires security-core:

I use CSRF in some forms not related to Security, so I want CSRF but I don't want the entire Security package. Why is this important to me?

Because symfony/security-csrf is a tiny 18-file and 0.06 MB on disk package, whereas symfony/security-core is a big 258-file and 1.1 MB on disk package.

Moreover, although CSRF requires the entire Security package, it only uses two tiny exception classes from it:

Here:

And here:

So maybe we can decouple these packages? Thanks!