Problem/Motivation
I think we should flat-out remove the dependency. Here's why:
- Asset Packagist's domain has expired and it is now in a roughly 45-day holding pattern before anyone can snap it up and potentially serve malicious packages.
- I can't find a native Packagist release of Cropper, or its successor, jQuery Cropper. At least, I can't find one that seems to be maintained and up to date with the actual library.
- When Lightning was being shipped as a full distribution, there was more of an imperative to ship all of the dependencies at once, and make it "just work". Now that the Lightning distribution is well past its end of life, Lightning Media, which actually has the dependency on
bower-asset/cropper, has more latitude to ask developers to install the dependency into their site'slibrariesdirectory manually. Which sucks, but as far as I know, Drupal still doesn't have a good mechanism for installing and maintaining JavaScript dependencies into a site.
Given the terrifying specter of potential security implications brought on by Asset Packagist's demise, I think the best course of action here is to just remove the dependency and expect people to install Cropper manually. Image Widget Crop, the module which actually uses the library, has some reasonable hook_requirements() checks to verify the presence of the library.
If a native, properly maintained Packagist release of the library appears one day, we can always introduce a new dependency on it. But the priority right now is to drop Asset Packagist.
Steps to reproduce
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | 3275867-3.patch | 455 bytes | phenaproxima |
Comments
Comment #2
phenaproximaComment #3
phenaproximaAnd, patch.
Given the rationale in the issue summary, and the wide-ranging impact dealt by the loss of Asset Packagist, I'm going to make the executive decision to commit this immediately to the 5.0.x branch, where breaking changes like this are acceptable, and backport as necessary.
Comment #4
phenaproximaComment #6
phenaproximaComment #7
phenaproxima