[3.0.0] ModuleLoader registers dependencies from disabled modules #529

Summary

In v3.0.0-rc.1, disabled modules still contribute DI bindings.

Reproduction

1. In shared/config/modules.php, define two modules, one enabled and one disabled:

return [
    'EnabledModule' => ['prefix' => 'enabled', 'enabled' => true],
    'DisabledModule' => ['prefix' => 'disabled', 'enabled' => false],
];

2. Add modules/DisabledModule/config/dependencies.php with at least one binding.
3. Boot app / instantiate Quantum\\Module\\ModuleLoader.

Actual behavior

Bindings from DisabledModule are still loaded and registered in DI.

Expected behavior

When enabled => false, module dependencies should not be loaded/registered.

Code reference

src/Module/ModuleLoader.php

• loadModulesDependencies() iterates over all module configs and merges dependencies without checking enabled.
• isModuleEnabled() is currently only used by loadModulesRoutes().

Impact

• enabled appears to be a full module toggle but currently acts as routes-only toggle.
• Disabled modules can still alter container bindings and runtime behavior.
• Can cause hard-to-debug overrides in production.

Suggested fix

Apply the same enablement gate in loadModulesDependencies():

• Skip modules where enabled is false.

Also add regression tests to guarantee:

• disabled module deps are not registered
• enabled module deps are registered
• route-loading behavior remains unchanged

Release note

This should be treated as a 3.0.0 release blocker and documented in upgrade notes as a behavior correction from RC.