Install the front-end libraries with Composer from Packagist instead of the drupal-libraries-sync Node script

Problem/Motivation

Varbase 11 used to obtain six front-end libraries by running recipes/varbase_starter/scripts/drupal-libraries-sync.js, a Node script that copied files out of node_modules/ into web/libraries/, driven by a drupal-libraries block, six npm dependencies and a postinstall hook in package.json. That is replaced by Composer packages on Packagist, each required by the module or the varbase_* recipe that actually loads it.

• vardot/aos 2.3.4 (new)
• vardot/jquery.fancytree 2.38.5 (new)
• vardot/ckeditor5-media-embed-drupal 47.6.2 (new)
• vardot/ace 1.44.0 (refreshed from a 2017 fork)
• vardot/dropzone 5.9.3 (refreshed from a 2017 fork)
• swagger-api/swagger-ui, already required by drupal/openapi_ui_swagger; it only needed an installer path.

All are type: drupal-library except swagger-api/swagger-ui, which is type: library.

Defect: licensing

The npm constraint "@ckeditor/ckeditor5-media-embed": "^47.6.0" was resolving to 47.7.2, which is the CKEditor 5 Long Term Support edition, commercial licence only with no GPL option, inside a GPL-2.0-or-later distribution. 47.6.2 is the last GPL dual-licensed release of that line, and it is exactly what Drupal 11.4 core bundles. A CKEditor 5 plugin must match core's CKEditor 5 version or the editor fails with ckeditor-duplicated-modules.

Defect: broken library

dropzonejs.libraries.yml loads /libraries/dropzone/dropzone-min.js, but no Dropzone 5 release ever shipped that filename: v5 ships dist/min/dropzone.min.js, and the flat name is Dropzone 6, in beta since 2021. So syncing dropzone@5 from npm could never satisfy it and the file was simply absent. vardot/dropzone 5.9.3 ships the stable minified build under the names the module declares; the status report now reads dropzonejs_library: OK.

Defect: duplicate download

swagger-api/swagger-ui was already required by drupal/openapi_ui_swagger and landed in vendor/ where nothing can serve it, while swagger-ui-dist was fetched a second time from npm. It is type: library, not drupal-library, and oomphinc/composer-installers-extender cannot place it, because adding library to installer-types makes composer/installers claim every library-type package and die with Package type "library" is not supported. mnsami/composer-custom-directory-installer, which the openapi_ui_swagger README documents, works.

Steps to reproduce

1. Create a project from the 11.0.x Varbase Project template.
2. Inspect web/libraries/ and the Status report.
3. The libraries only appear if the postinstall yarn hook ran and copied them out of node_modules/; /libraries/dropzone/dropzone-min.js never appears at all, and swagger-ui is downloaded twice while the Composer copy sits unusable in vendor/.

Environment: Drupal core 11.4.5, Varbase 11.0.x, PHP 8.4, MariaDB, DDEV.

Proposed resolution

• package.json: remove the dependencies and drupal-libraries blocks and the drupal-libraries-sync and postinstall scripts.
• composer.json: remove the whole drupal-libraries-sync script chain and the post-create-project-cmd hook that called it.
• composer.json: require mnsami/composer-custom-directory-installer and add the two installer paths a generic web/libraries/{$name} rule cannot place, namely web/libraries/swagger-ui for swagger-api/swagger-ui, and the nested web/libraries/ckeditor5/plugins/media-embed that drupal/ckeditor_media_embed loads from.
• Correct the four CI comments that described the postinstall sync.

Verified on a freshly installed Varbase 11.4.5 site in DDEV, with every package resolved from Packagist and no VCS repositories:

• 14/14 declared library files present on disk; 10/10 assets return HTTP 200.
• 7/7 Drupal libraries discovered, every asset resolving, all 7 rendering the Composer paths.
• Status report green: ace_editor OK, dropzonejs_library OK, taxonomy_manager OK, media-embed installed at 47.6.2 matching core 47.6.2.
• ace_editor PHPUnit: 69 tests, 709 assertions, 0 failures. phpcs clean on every changed PHP file.
• yarn install succeeds with none of the six npm library packages present.

Remaining tasks

• ✅ Release varbase_project-11.0.7
• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ✅ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• The front-end libraries now install with Composer from Packagist. The drupal-libraries-sync Node script, its package.json dependencies and the postinstall hook are removed.