Update Symfony 5 components to 5.3-rc1

Do we know when rc1 will be released?

Also, this is going to run into #3186364: Allow pre-release dependencies in Drupal pre-release milestones, at the moment one of the build tests will fail due to this.

Ok here is an attempt

I chatted with @xjm and she mentioned there was an extra step for indirect dependencies. I think that meant `core/composer.json`. I couldn't find the issue but I think this what she said to do.

if someone knows the issue with those instructions and I can double check.

+++ b/core/composer.json
@@ -23,7 +23,7 @@
-        "symfony/mime": "^5.2",
+        "symfony/mime": "^5.3",

With this patch, symfony/mime is still on 5.2.6 after a composer install. It needs to be on a beta or RC version of 5.3, which will only happen if it's specified specifically.

ok. I think this is it

It's still on 5.2.6 after composer install with that as well unfortunately. Also note that the version is not correctly being updated in composer/Metapackage/CoreRecommended/composer.json after following the steps in the handbook page, which is another way you can also tell it's not going to work. I think it needs to specify the exact beta of symfony/mime, as with the other packages.

#5 just needed an explicit composer update. You have to update both drupal/core as that is the owner of the composer.json, and symfony/mime as that is the package we want to update.

Steps from #5:

$ git checkout 9.2.x
$ git reset --hard
$ git pull
$ curl https://www.drupal.org/files/issues/2021-05-13/3213295-5.patch | patch -p1
$ composer update drupal/core symfony/mime
...
Lock file operations: 0 installs, 2 updates, 0 removals
  - Upgrading drupal/core (9.2.x-dev 84de0d6 => 9.2.x-dev d5d7dfe)
  - Upgrading symfony/mime (v5.2.6 => v5.3.0-BETA3)
...
$ composer-lock-diff --no-links
+--------------------+--------+--------------+
| Production Changes | From   | To           |
+--------------------+--------+--------------+
| symfony/mime       | v5.2.6 | v5.3.0-BETA3 |
| symfony/var-dumper | v5.2.6 | v5.3.0-BETA3 |
+--------------------+--------+--------------+

+------------------------+--------+--------------+
| Dev Changes            | From   | To           |
+------------------------+--------+--------------+
| symfony/phpunit-bridge | v5.2.6 | v5.3.0-BETA4 |
+------------------------+--------+--------------+

Also note that one package is beta4 while the others are beta3; Symfony changed their tagging policy recently and patch levels for individual components will no longer be bumped if there were no changes.

rc1 is not out yet, so this is as far as we can go for now.

See also #3210632: Update dependencies for Drupal 9.2 where we are a few patchlevels out of date on several other components, I think it is OK to update these before beta1 as well?

Looks like drupal/recommended only likes stable versions?

// At the moment, we are only testing stable versions.
Right here

Beta !== Stable, so no-go at the moment?

@Spokje that is what #3186364: Allow pre-release dependencies in Drupal pre-release milestones is designed to solve

5.3.0-RC1 got released today: https://symfony.com/blog/symfony-5-3-0-rc1-released.

I made this patch by:
- searching for symfony/mime in all composer.json files and setting the version to 5.3.0-rc1
- searching for symfony/var-dumper in all composer.json files and setting the version to 5.3.0-beta3 (the latest one currently available)
- searching for symfony/phpunit-bridge ​in all composer.json files and setting the version to 5.3.0-rc1

And then running:

composer update drupal/core symfony/mime symfony/var-dumper symfony/phpunit-bridge

I'm uploading both the standalone patch (which should fail ComposerProjectTemplatesTest) and a combined patch that includes #3186364-21: Allow pre-release dependencies in Drupal pre-release milestones (which should resolve that failure).

See #3186364-22: Allow pre-release dependencies in Drupal pre-release milestones.

See #3186364-24: Allow pre-release dependencies in Drupal pre-release milestones.

I'm tempted to mark this postponed on #3186364: Allow pre-release dependencies in Drupal pre-release milestones, except I'm holding off on doing so, because the (non-combined) patch in #15 could still benefit from a human review (considering that earlier comments on this issue surfaced problems with earlier patches) to make sure that all looks right in terms of whether all of the composer.json and composer.lock changes are correct. Once that's reviewed, the correct status for this issue will be "postponed" on #3186364: Allow pre-release dependencies in Drupal pre-release milestones.

Re #24: If I do my Composer-VooDoo on 9.3.x I get almost the same results.

The only difference is that (by now) there's a v5.3.0-RC1 for symfony/var-dumper as well (https://github.com/symfony/var-dumper/tree/v5.3.0-RC1), instead of the v5.3.0-BETA3 in the uncombined patch in #15. I think you/me/we want that.

(BTW: Am I the only one that finds the BETA or RC a bit shouty?)

+++ b/composer.json
@@ -25,8 +25,8 @@
-        "symfony/phpunit-bridge": "^5.1.4",
-        "symfony/var-dumper": "^5.1.2",
+        "symfony/phpunit-bridge": "^5.3.0-rc1",
+        "symfony/var-dumper": "^5.3.0-beta3",

+++ b/composer.lock
@@ -569,7 +569,7 @@
-                "symfony/mime": "^5.2",
+                "symfony/mime": "^5.3.0-rc1",

I don't think we should be bumping the version numbers. We temporarily want to provide RC dependencies as the recommended versions, but we still want to allow users to install with the earlier versions - therefore I think these should be e.g. ^5.1.4@rc which should satisfy both these things.

we still want to allow users to install with the earlier versions

Why do we still want to allow that? We don't yet do testing for versions earlier than in the lock file (#2874198: Create and run dependency regression tests for core), so we won't know when we break something against them.

This probably needs a reroll due to #3215039: Update symfony dependencies to latest release.

I tried reviving #3044175: [DO NOT COMMIT] Vendor minimum testing issue to find out what our real minimum dependency versions should be.

Straight-up reroll of 3213295-15.patch, nothing has been addressed about the discussion in #26/#27

$ composer-lock-diff --no-links
+--------------------+--------+------------+
| Production Changes | From   | To         |
+--------------------+--------+------------+
| symfony/mime       | v5.2.9 | v5.3.0-RC1 |
| symfony/var-dumper | v5.2.8 | v5.3.0-RC1 |
+--------------------+--------+------------+

+------------------------+--------+------------+
| Dev Changes            | From   | To         |
+------------------------+--------+------------+
| symfony/phpunit-bridge | v5.2.9 | v5.3.0-RC1 |
+------------------------+--------+------------+

#30 is missing the test changes so it will fail.

+++ b/composer.json
@@ -25,8 +25,8 @@
+        "symfony/var-dumper": "^5.3.0-beta3",

This patch just changes it to ^5.3.0-rc1, because that got released after #15.

Re #26, thank you for #29, and with that issue in place, I'd be okay in principle with continuing to allow the lower minimums. However,

I think these should be e.g. ^5.1.4@rc which should satisfy both these things.

I tried that, but so long as we have "prefer-stable": true in our root composer.json, I can't get composer.lock updated to the RC versions. I don't think we should remove the global "prefer-stable": true, and I don't know how to locally override the preference on a per-package basis. Therefore, this patch does not implement #26, but if you know of how to do it (and have it stick on a subsequent composer update), please post a patch.

This is #33 combined with #3186364-51: Allow pre-release dependencies in Drupal pre-release milestones, plus setting the ComposerProjectTemplatesTest::MINIMUM_STABILITY constant from that patch to 'RC' (whereas, it's 'stable' in that patch).

Re-ordered a test on patch in #33 (which still applies) after #3186364: Allow pre-release dependencies in Drupal pre-release milestones got committed.

EDIT: Test won't change much since as stated in #34

plus setting the ComposerProjectTemplatesTest::MINIMUM_STABILITY constant from that patch to 'RC'

isn't in patch #33.

_First_ read, _then_ order re-test...

Re #33 I am sure I managed to get composer to update to RC versions in the past with some command line trickery but I'm now unable to reproduce it. You can see at https://semver.mwl.be/?package=symfony%2Fmime&constraint=%5E5.2&stabilit... that it should be able to select symfony/mime:5.3.0-rc1 with this constraint but prefer-stable must be taking 5.2.x in preference.

However, could we still ship with a lock file that refers to the RC versions while having the original constraints in composer.json (by updating composer.json, updating the components, reverting composer.json and running composer update drupal/core only)? If we do that then anyone who uses our locked versions (i.e. core-recommended) should get the RC versions at least? Or is this just a waste of time and we should just bump our minimum dependencies here?

Rerolled for #3215280: Bump minimum dependencies required for tests to pass and #3186364: Allow pre-release dependencies in Drupal pre-release milestones. Because of the former, can't do an interdiff, but here's a regular diff. There are some context line differences, but the only actual differences are the lines with a - or + following a > or <

Looks good to me, RTBC assuming tests pass.