I've upgraded to Thunder 8.x-3.0-rc1 hoping this would resolve module vulnerability issues as well but Field Group 8.x-1.0 is still in use in Thunder 3.0 even though it has not supported for a while, creating a major security risk and Field Group 8.x-3.0-rc1 (2019-May-23) is the recommended version but Thunder does not allow upgrade to Field Group 8.x-3.0-rc1. am I missing something or is there no fix for this security hole right now?

[mysite]# composer require drupal/field_group:^3.0
./composer.json has been updated
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - thunder/thunder-distribution 3.3.0-rc1 requires drupal/field_group ^1.0 -> satisfiable by drupal/field_group[1.x-dev].
    - thunder/thunder-distribution 3.3.0-rc1 requires drupal/field_group ^1.0 -> satisfiable by drupal/field_group[1.x-dev].
    - thunder/thunder-distribution 3.3.0-rc1 requires drupal/field_group ^1.0 -> satisfiable by drupal/field_group[1.x-dev].
    - Conclusion: don't install drupal/field_group 1.x-dev
    - Installation request for thunder/thunder-distribution 3.3.0-rc1 -> satisfiable by thunder/thunder-distribution[3.3.0-rc1].


Installation failed, reverting ./composer.json to its original content.

Comments

Dru Pal created an issue. See original summary.

daniel.bosen’s picture

daniel.bosen
he/him
commented

Hi!
The problem with the field group update was, that we could not update paragraphs, due to massive problems when updating to paragraphs 1.7 and 1.8. Field group depends on the update of paragraph module.
With last weeks release of Paragraphs 1.9 most of these update problems are gone, and we are going to first update paragraphs and subsequently field groups.
We are still in the process of testing paragraphs 1.9 and field group 3.0. If no problems come up anymore, we will release with those modules soon.

dru pal’s picture

dru pal commented

OK that confirms it for me. Good to know.

daniel.bosen’s picture

daniel.bosen
he/him
commented
Status: Active » Fixed

Field group is now in Thunder 2 and Thunder 3

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.