Bump drupal/vendor_stream_wrapper to ^2 in composer.json [#3253237]

Problem/Motivation

https://www.drupal.org/project/vendor_stream_wrapper/releases/2.0.0 is out, it would be good to have a new release using that.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comment	File	Size	Author
#6	jquery_colorpicker_removed_vendor_stream_wrapper_3253237.patch	3.38 KB	ashetkar
#5	Fixed-jquery-colorpicker-security-issue.patch	3.49 KB	ashetkar

Issue fork jquery_colorpicker-3253237

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3253237-bump-drupalvendorstreamwrapper-to changes, plain diff MR !5
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

8 December 2021 at 09:06

mondrake created an issue. See original summary.

Comment #2

davemybes commented 2 February 2022 at 22:09

Well, https://www.drupal.org/project/vendor_stream_wrapper is now no longer supported due to a security issue, so this could get tricky. There is no movement on a new maintainer for the module yet either.

Comment #3

mondrake

🇮🇹

commented 4 February 2022 at 16:50

Pretty weird, from a new release two months ago to completely abadoned? Anyone knows what's going on? I filed #3262541: Access bypass: view any file in vendor directory.

Comment #4

4 March 2022 at 11:11

mondrake opened merge request !5

Comment #5

ashetkar commented 6 June 2022 at 13:41

Status:

Active

» Needs review

Status	File	Size
new	Fixed-jquery-colorpicker-security-issue.patch	3.49 KB

Here's patch which removes vendor stream wrapper dependency from Jquery Colorpicker module. I have changed status to need review.

Comment #6

ashetkar commented 7 June 2022 at 10:18

Status	File	Size
new	jquery_colorpicker_removed_vendor_stream_wrapper_3253237.patch	3.38 KB

1 file was hidden/shown/deleted

Status	File	Size
hidden	Fixed-jquery-colorpicker-security-issue.patch	3.49 KB

Uploaded new patch after removing whitespace and trailing whitespace

Comment #7

mondrake

🇮🇹

commented 7 June 2022 at 10:55

1 file was hidden/shown/deleted

Status	File	Size
hidden	jquery_colorpicker_removed_vendor_stream_wrapper_3253237.patch	3.38 KB

@ashetkar thank you, but your patch is removing the dependency, which is not the scope of this issue. I see what you are trying to do here, it has its own merit, but I'd suggest you open a separate issue to pursue that.

Here we'd bump the dependency if/when the security issue upstream is solved.