In #2494073: Prevent modules which have unmet Composer dependencies from being installed, we've found a solution that uses composer/semver to do checking for package constraints. Attached patch adds that package to the repository.
I executed the following command: $ composer require composer/semver 1.*.
I manually edited core/composer.json and ran composer update composer/semver.
| Issue category | Task because it is an external library addition |
|---|---|
| Issue priority | Major because it blocks a major issue - #2494073: Prevent modules which have unmet Composer dependencies from being installed |
| Comment | File | Size | Author |
|---|---|---|---|
| #16 | require_the-2575469-16.patch | 49.44 KB | hussainweb |
Comments
Comment #2
borisson_Comment #3
dawehnerIMHO we should use ~2.0 as version constraint, its something we use in more places now.
Comment #4
bojanz commented+1 to adding the library.
Comment #5
borisson_Used
$ composer require composer/semver ~1.0for attached patch.Comment #6
webflo commentedComment #7
hussainwebRerolled the patch. We don't have a
core/vendoranymore.Also, marking this as major as it blocks a major issue - #2494073-68: Prevent modules which have unmet Composer dependencies from being installed.
Comment #8
dawehnerThis is RTBC, of course
Comment #10
hussainwebRerolling...
Comment #11
hussainwebRTBC as per #8. It was just a reroll.
Comment #13
webchickLibrary addition = needs framework manager sign-off.
For that sign-off, it'd be good if the issue summary had a beta evaluation; in particular to understand why we'd want to do this at the 11th hour of RC1 and not defer to 8.1.x instead. Seems like a nice to have?
Comment #14
bojanz commentedI would agree that this is a "nice to have". It depends on how important you consider #2494073: Prevent modules which have unmet Composer dependencies from being installed.
Comment #15
alexpottI like using this package to do #2494073: Prevent modules which have unmet Composer dependencies from being installed - it makes sense. Needs a reroll though.
Comment #16
hussainwebRerolling and setting to RTBC as per #8.
Comment #17
hussainwebComment #18
alexpottI think we need to complete #2494073: Prevent modules which have unmet Composer dependencies from being installed before release as a broken site due to module install would be hard for users to recover from. Discussed with @catch, @xjm and @webchick we agreed to commit this under committer discretion since it unblocks that issue.
Committed b834fcd and pushed to 8.0.x. Thanks!
Comment #20
hussainweb@alexpott: Thank you. I have set that issue to Needs Review with a fresh patch - #2494073: Prevent modules which have unmet Composer dependencies from being installed.
Comment #22
xjm