Problem/Motivation

#3058116: Remove paragonie/random_compat as a top-level dependency from 8.8.x vs https://git.drupalcode.org/project/drupal/-/blob/8.9.x/composer/Metapack...

Proposed resolution

Remove it for real?

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#7 3121781-7.patch602 bytesadamzimmermann

Issue fork drupal-3121781

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Charlie ChX Negyesi created an issue. See original summary.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

jungle’s picture

jungle
He/Him
Location Chongqing, China
commented
Version: 9.1.x-dev » 8.9.x-dev
Status: Active » Needs review

symfony/polyfill-php70 v1.17.0 requires paragonie/random_compat (~1.0|~2.0|~9.99)

It seems we can not remove it ATM

ghost of drupal past’s picture

ghost of drupal past
he/him
commented

https://www.drupal.org/node/3044409

Drupal security updates will begin requiring PHP 7 as early as Drupal 8.8.0 (December 2019)

https://www.drupal.org/project/drupal/releases/8.8.0

PHP 5.5 and 5.6 support was officially removed in 8.7, but Drupal still allowed sites to apply security updates on those PHP 5 versions. Drupal 8.8.0 ends that support and updates will now fail if servers are not updated to at least PHP 7.0.8.

adamzimmermann’s picture

adamzimmermann commented

When using the "printable" module, which indirectly requires "mpdf/mpdf", which has this requirement:

paragonie/random_compat ^1.4|^2.0|^9.99.99

This conflicts with the constraint in "drupal/core-recommended" for 8.9.x.

"paragonie/random_compat": "v9.99.99",

This is keeping me stuck with "drupal/core" which is no longer the best practice. The thing that started this process for me was trying to update a codebase to use "drupal/core-recommended" to follow the latest best practices.

Given the updates in #4, it seems that we could remove this requirement, correct?

I'm happy to submit that patch if others are on board.

edit: I went ahead and submitted a MR.

adamzimmermann opened merge request !166

adamzimmermann’s picture

adamzimmermann commented
StatusFileSize
new 3121781-7.patch602 bytes

Attaching a patch for 8.9.11 to test/use locally, as the patch from my MR was failing to apply locally.

(https://git.drupalcode.org/project/drupal/-/merge_requests/166.patch)

adamzimmermann’s picture

adamzimmermann commented

Realized that ./composer isn't in the packaged Drupal distribution so the patch fails.

I'm also not sure why one test passed and one test failed.

Any insight would be much appreciated or help getting this to a state where we can commit it.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Status: Needs review » Closed (outdated)
Issue tags: +Bug Smash Initiative

The was fixed in #3168514: Remove unnecessary polyfills from composer.lock. I am closing as outdated.

nicxvan closed merge request !166