Problem/Motivation

I think we should flat-out remove the dependency. Here's why:

  1. Asset Packagist's domain has expired and it is now in a roughly 45-day holding pattern before anyone can snap it up and potentially serve malicious packages.
  2. I can't find a native Packagist release of Cropper, or its successor, jQuery Cropper. At least, I can't find one that seems to be maintained and up to date with the actual library.
  3. When Lightning was being shipped as a full distribution, there was more of an imperative to ship all of the dependencies at once, and make it "just work". Now that the Lightning distribution is well past its end of life, Lightning Media, which actually has the dependency on bower-asset/cropper, has more latitude to ask developers to install the dependency into their site's libraries directory manually. Which sucks, but as far as I know, Drupal still doesn't have a good mechanism for installing and maintaining JavaScript dependencies into a site.

Given the terrifying specter of potential security implications brought on by Asset Packagist's demise, I think the best course of action here is to just remove the dependency and expect people to install Cropper manually. Image Widget Crop, the module which actually uses the library, has some reasonable hook_requirements() checks to verify the presence of the library.

If a native, properly maintained Packagist release of the library appears one day, we can always introduce a new dependency on it. But the priority right now is to drop Asset Packagist.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#3 3275867-3.patch455 bytesphenaproxima

Comments

phenaproxima created an issue. See original summary.

phenaproxima’s picture

Issue summary: View changes
phenaproxima’s picture

Status: Active » Needs review
StatusFileSize
new455 bytes

And, patch.

Given the rationale in the issue summary, and the wide-ranging impact dealt by the loss of Asset Packagist, I'm going to make the executive decision to commit this immediately to the 5.0.x branch, where breaking changes like this are acceptable, and backport as necessary.

phenaproxima’s picture

Issue summary: View changes

  • phenaproxima committed fae1327 on 5.0.x
    Issue #3275867 by phenaproxima: Remove dependency on bower-asset/cropper
    
phenaproxima’s picture

Status: Needs review » Fixed
phenaproxima’s picture

Issue summary: View changes

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.