Hi there, In the dependency cleanup effort we've got going on at the Grok cavesprint here at my house, we have moved code around some more. zope.security was already defining ZCML directives so we've moved the <class> directive from zope.app.component and and the <module> directive from zope.app.security into zope.security as well. These only need things that are in zope.security already (or its dependencies) and the directives are about security declarations, so they seem to fit quite well into their new place. This way we can (eventually) lift some dependencies of packages on zope.app.security and zope.app.component and point it to zope.security instead, which will help clean up the dependency structures. We've left backwards compatibility imports in place in the zope.app.* packages (hopefully enough of it) so that existing code will continue to work. Regards, Martijn