Add farbtastic library to color module because it was deprecated in core 9.5

I don't think we should add the library code to the module because that's agains the security team policy: https://www.drupal.org/docs/develop/git/setting-up-git-for-drupal/drupal.... Maybe we could use a CDN or libraries API?

One of the exceptions to the no 3rd party library rules is:

is no longer maintained by the original author;

(per https://www.drupal.org/docs/develop/git/setting-up-git-for-drupal/drupal...)

So... I think it would be OK to include it directly if other options are tricky.

Do we even need Farbtastic any more? The reason we used it was because long ago, browsers did not have color pickers. But since IE11 is no more all modern browsers support <input type="color"> - so should we consider refactoring the module to use the native color picker instead?

Per @xjm.

So, here too, we need to deal with the whole "how to ship an external asset library" question. For CKEditor 4, an exemption was made because of the vast security implications and extremely painful build process — see #3306909: Get Drupal Security Team approval to commit vendor/ckeditor.js to the drupal/ckeditor project.

That is not true here: https://github.com/mattfarina/farbtastic requires no build process whatsoever.

I think that here too we want to use an approach like https://git.drupalcode.org/project/quickedit/-/merge_requests/13/diffs?c... load https://cdn.jsdelivr.net/gh/mattfarina/farbtastic@1.3u/farbtastic.js from that external CDN.

Also note that Drupal core claims to ship with version 1.2 but according to https://github.com/mattfarina/farbtastic/tags that simply does not exist 🤷

Thoughts?

The missing 1.2 release has been an issue for years: https://github.com/mattfarina/farbtastic/issues/27

I don't know what the difference is between that and 1.3u, if anything.

edit: there seems to be no difference, given the output of git log --p --follow core/assets/vendor/farbtastic/farbtastic.js; we added a header and moved the file around, but the code itself was last updated in #623292: Update Farbtastic

I *think* that core.libraries.yml is wrong, and should say we are shipping 1.3u instead.

From what I remember that 1.3 is yet another version.

Given that it's way way unmaintained, there is no tag = no CDN version, it could be an exception maybe?

huh, yeah the version is wrong. I think I had it confused with joyride. so ignore my comment in #10

So yeah the cdn solution would work +1 to that.

Something like this

@nod_ the

Drupal\Core\Extension\Exception\UnknownExtensionException: Unknown themes: bartik.

failure means that we need to update the *.info.yml file to add a test-only dependency on the Bartik contrib theme, since https://git.drupalcode.org/project/color/-/blob/2.x/color.info.yml does not yet do that.

Had to do something similar for contrib Quick Edit the other day: https://git.drupalcode.org/project/quickedit/-/commit/00a8710d0796286626...

all right, sweet.