Update Composer dependencies to the latest minor and patch versions [#3278162]

Problem/Motivation

10.0.0-alpha4 and 9.4.0-alpha1 will be released next week. Several Composer dependencies can be updated to newer versions.

Proposed resolution

Update Composer dependencies to the latest minor and patch versions prior to 10.0.0-alpha4 and 9.4.0-alpha1.

Remaining tasks

NR.

User interface changes

N/A

API changes

Hopefully not.

Data model changes

N/A

Release notes snippet

10.0.x:
Drupal core's pinned Composer dependency versions have been updated for the latest minor and patch releases. The composer/xdebug-handler and sebastian/type dependencies have received major version updates that remove support for PHP versions not supported for Drupal 10.

Other branches:
10.0.x Drupal core's pinned Composer dependency versions have been updated for the latest minor and patch releases. The composer/xdebug-handler dependency has received a major version update that removes support for PHP versions not supported for Drupal 10.

Comment	File	Size	Author
#12	3278162-12-10.0.x.patch	74.69 KB	longwave
#8	3278162-8-10.0.x.patch	79.55 KB	longwave
#8	3278162-8-9.5.x.patch	105.79 KB	longwave
#8	3278162-8-9.4.x.patch	106.09 KB	longwave
#2	update-9.4.x.patch	60.19 KB	xjm
#2	update-9.5.x.patch	60.03 KB	xjm
#2	update-10.0.x.patch	37.81 KB	xjm

Comments

Comment #1

2 May 2022 at 00:01

xjm created an issue. See original summary.

Comment #2

xjm

she/her

English

commented 2 May 2022 at 00:02

Status:

Active

» Needs review

Status	File	Size
new	update-10.0.x.patch	37.81 KB
new	update-9.5.x.patch	60.03 KB
new	update-9.4.x.patch	60.19 KB

Comment #3

xjm

she/her

English

commented 2 May 2022 at 00:09

+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -29,33 +29,33 @@
-        "symfony/polyfill-iconv": "v1.24.0",
+        "symfony/polyfill-iconv": "v1.25.0",
         "symfony/polyfill-intl-grapheme": "v1.25.0",
-        "symfony/polyfill-intl-idn": "v1.24.0",
+        "symfony/polyfill-intl-idn": "v1.25.0",
         "symfony/polyfill-intl-normalizer": "v1.25.0",
         "symfony/polyfill-mbstring": "v1.25.0",
         "symfony/polyfill-php80": "v1.25.0",
-        "symfony/polyfill-php81": "v1.24.0",
-        "symfony/process": "v6.0.5",
+        "symfony/polyfill-php81": "v1.25.0",
+        "symfony/process": "v6.0.8",

10.0.x through 9.4.x have minor updates on the polyfills.

+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -9,18 +9,18 @@
-        "composer/semver": "3.2.6",
+        "composer/semver": "3.3.2",
...
-        "laminas/laminas-diactoros": "2.8.0",
+        "laminas/laminas-diactoros": "2.9.2",
         "laminas/laminas-escaper": "2.9.0",
-        "laminas/laminas-feed": "2.15.0",
-        "laminas/laminas-stdlib": "3.6.1",
+        "laminas/laminas-feed": "2.17.0",
+        "laminas/laminas-stdlib": "3.7.1",

Minor updates for 9.4.x. Should we increase constraints for forward-compatibility with the latest minors in case of sec releases? Could be a followup.

+++ b/composer/Metapackage/PinnedDevDependencies/composer.json
@@ -28,7 +28,7 @@
-        "phpdocumentor/type-resolver": "1.5.1",
+        "phpdocumentor/type-resolver": "1.6.1",

Another minor update but probably low-impact.

Comment #4

2 May 2022 at 05:40

The last submitted patch, 2: update-9.5.x.patch, failed testing. View results

Comment #5

xjm

she/her

English

commented 2 May 2022 at 11:01

Known random fail above in the results. I retested it.

Comment #6

xjm

she/her

English

commented 2 May 2022 at 16:01

Issue tags:

+Needs followup

Tagging for a follow up for #3. I think we should keep the scope of this issue to doing the lockfile dependency updates for the forward branches.

Comment #7

longwave

he/him

English

commented 4 May 2022 at 16:51

Status:

Needs review

» Needs work

There are a bunch of dev dependencies that can be updated and laminas/laminas-diactoros 2.10.0 is also out.

Comment #8

longwave

he/him

English

commented 4 May 2022 at 16:55

Status:

Needs work

» Needs review

Status	File	Size
new	3278162-8-9.4.x.patch	106.09 KB
new	3278162-8-9.5.x.patch	105.79 KB
new	3278162-8-10.0.x.patch	79.55 KB

9.4.x and 9.5.x:

Patches created with composer update --with=phpunit/phpunit:^8 --with=drupal/coder:8.3.13

+------------------------------------+----------+----------+
| Production Changes                 | From     | To       |
+------------------------------------+----------+----------+
| composer/semver                    | 3.2.6    | 3.3.2    |
| doctrine/lexer                     | 1.2.1    | 1.2.3    |
| laminas/laminas-diactoros          | 2.8.0    | 2.10.0   |
| laminas/laminas-feed               | 2.15.0   | 2.17.0   |
| laminas/laminas-stdlib             | 3.6.1    | 3.7.1    |
| symfony/console                    | v4.4.34  | v4.4.41  |
| symfony/debug                      | v4.4.31  | v4.4.41  |
| symfony/dependency-injection       | v4.4.34  | v4.4.41  |
| symfony/deprecation-contracts      | v2.5.0   | v2.5.1   |
| symfony/error-handler              | v4.4.34  | v4.4.41  |
| symfony/event-dispatcher           | v4.4.34  | v4.4.37  |
| symfony/event-dispatcher-contracts | v1.1.11  | v1.1.12  |
| symfony/http-client-contracts      | v2.5.0   | v2.5.1   |
| symfony/http-foundation            | v4.4.34  | v4.4.41  |
| symfony/http-kernel                | v4.4.35  | v4.4.41  |
| symfony/mime                       | v5.4.0   | v5.4.8   |
| symfony/polyfill-ctype             | v1.23.0  | v1.25.0  |
| symfony/polyfill-iconv             | v1.23.0  | v1.25.0  |
| symfony/polyfill-intl-idn          | v1.23.0  | v1.25.0  |
| symfony/polyfill-intl-normalizer   | v1.23.0  | v1.25.0  |
| symfony/polyfill-mbstring          | v1.23.1  | v1.25.0  |
| symfony/polyfill-php80             | v1.23.1  | v1.25.0  |
| symfony/process                    | v4.4.35  | v4.4.41  |
| symfony/routing                    | v4.4.34  | v4.4.41  |
| symfony/serializer                 | v4.4.35  | v4.4.41  |
| symfony/service-contracts          | v2.5.0   | v2.5.1   |
| symfony/translation                | v4.4.34  | v4.4.41  |
| symfony/translation-contracts      | v2.5.0   | v2.5.1   |
| symfony/validator                  | v4.4.35  | v4.4.41  |
| symfony/var-dumper                 | v5.4.0   | v5.4.8   |
| symfony/yaml                       | v4.4.34  | v4.4.37  |
| twig/twig                          | v2.14.11 | v2.14.13 |
+------------------------------------+----------+----------+

+------------------------------------+---------+---------+
| Dev Changes                        | From    | To      |
+------------------------------------+---------+---------+
| behat/mink                         | v1.9.0  | v1.10.0 |
| behat/mink-selenium2-driver        | v1.5.0  | v1.6.0  |
| composer/xdebug-handler            | 2.0.2   | 3.0.3   |
| doctrine/instantiator              | 1.4.0   | 1.4.1   |
| instaclick/php-webdriver           | 1.4.10  | 1.4.14  |
| justinrainbow/json-schema          | 5.2.11  | 5.2.12  |
| myclabs/deep-copy                  | 1.10.2  | 1.11.0  |
| phar-io/version                    | 3.1.0   | 3.2.1   |
| phpdocumentor/type-resolver        | 1.5.1   | 1.6.1   |
| phpspec/prophecy                   | 1.14.0  | v1.15.0 |
| phpunit/php-file-iterator          | 2.0.4   | 2.0.5   |
| phpunit/phpunit                    | 8.5.21  | 8.5.26  |
| react/promise                      | v2.8.0  | v2.9.0  |
| sebastian/global-state             | 3.0.1   | 3.0.2   |
| seld/jsonlint                      | 1.8.3   | 1.9.0   |
| seld/phar-utils                    | 1.1.2   | 1.2.0   |
| sirbrillig/phpcs-variable-analysis | v2.11.2 | v2.11.3 |
| squizlabs/php_codesniffer          | 3.6.1   | 3.6.2   |
| symfony/browser-kit                | v4.4.27 | v4.4.37 |
| symfony/css-selector               | v4.4.27 | v4.4.37 |
| symfony/dom-crawler                | v4.4.30 | v4.4.39 |
| symfony/filesystem                 | v4.4.27 | v4.4.39 |
| symfony/finder                     | v4.4.30 | v4.4.41 |
| symfony/lock                       | v4.4.33 | v4.4.40 |
| symfony/phpunit-bridge             | v5.4.0  | v5.4.8  |
+------------------------------------+---------+---------+

10.0.x:

Patch created with composer update --with=drupal/coder:8.3.13

+------------------------------------+---------+---------+
| Production Changes                 | From    | To      |
+------------------------------------+---------+---------+
| composer/installers                | v2.0.1  | v2.1.1  |
| composer/semver                    | 3.3.1   | 3.3.2   |
| doctrine/lexer                     | 1.2.2   | 1.2.3   |
| guzzlehttp/guzzle                  | 7.4.1   | 7.4.2   |
| symfony/console                    | v6.0.5  | v6.0.8  |
| symfony/dependency-injection       | v6.0.3  | v6.0.8  |
| symfony/deprecation-contracts      | v3.0.0  | v3.0.1  |
| symfony/error-handler              | v6.0.3  | v6.0.8  |
| symfony/event-dispatcher-contracts | v3.0.0  | v3.0.1  |
| symfony/http-foundation            | v6.0.3  | v6.0.8  |
| symfony/http-kernel                | v6.0.4  | v6.0.8  |
| symfony/mime                       | v6.0.3  | v6.0.8  |
| symfony/polyfill-iconv             | v1.24.0 | v1.25.0 |
| symfony/polyfill-intl-idn          | v1.24.0 | v1.25.0 |
| symfony/polyfill-php81             | v1.24.0 | v1.25.0 |
| symfony/process                    | v6.0.5  | v6.0.8  |
| symfony/routing                    | v6.0.3  | v6.0.8  |
| symfony/serializer                 | v6.0.3  | v6.0.8  |
| symfony/service-contracts          | v3.0.0  | v3.0.1  |
| symfony/string                     | v6.0.3  | v6.0.8  |
| symfony/translation-contracts      | v3.0.0  | v3.0.1  |
| symfony/validator                  | v6.0.3  | v6.0.8  |
| symfony/var-dumper                 | v6.0.3  | v6.0.8  |
| twig/twig                          | v3.3.8  | v3.3.10 |
+------------------------------------+---------+---------+

+------------------------------------+---------+---------+
| Dev Changes                        | From    | To      |
+------------------------------------+---------+---------+
| behat/mink-selenium2-driver        | v1.5.0  | v1.6.0  |
| doctrine/instantiator              | 1.4.0   | 1.4.1   |
| instaclick/php-webdriver           | 1.4.10  | 1.4.14  |
| justinrainbow/json-schema          | 5.2.11  | 5.2.12  |
| mglaman/phpstan-drupal             | 1.1.9   | 1.1.16  |
| myclabs/deep-copy                  | 1.10.2  | 1.11.0  |
| phar-io/version                    | 3.1.0   | 3.2.1   |
| phpdocumentor/type-resolver        | 1.6.0   | 1.6.1   |
| phpstan/phpstan                    | 1.4.0   | 1.6.5   |
| phpunit/php-code-coverage          | 9.2.10  | 9.2.15  |
| phpunit/phpunit                    | 9.5.11  | 9.5.20  |
| sebastian/environment              | 5.1.3   | 5.1.4   |
| sebastian/global-state             | 5.0.3   | 5.0.5   |
| sebastian/type                     | 2.3.4   | 3.0.0   |
| seld/jsonlint                      | 1.8.3   | 1.9.0   |
| sirbrillig/phpcs-variable-analysis | v2.11.2 | v2.11.3 |
| symfony/dom-crawler                | v6.0.3  | v6.0.6  |
| symfony/filesystem                 | v6.0.6  | v6.0.7  |
| symfony/finder                     | v6.0.3  | v6.0.8  |
| symfony/lock                       | v6.0.3  | v6.0.7  |
| symfony/phpunit-bridge             | v6.0.3  | v6.0.8  |
+------------------------------------+---------+---------+

(Coder update requires more work, see #3262874: Update Coder to 8.3.15)

Comment #9

longwave

he/him

English

commented 4 May 2022 at 17:00

| composer/xdebug-handler            | 2.0.2   | 3.0.3   |

The breaking change here is dropping support for PHP below 7.2.5, which doesn't affect us; as this is a dev dependency only I don't see a problem with a major bump here.

Comment #10

spokje

Dutch

commented 5 May 2022 at 05:24

Status:

Needs review

» Reviewed & tested by the community

- TestBot = green
- Got the same results as @longwave when applying the given composer update commands.
- PHP 7.2 isn't supported by any 9.x/10.x release

RTBC for me.

Comment #11

mallezie

Dutch

Loenhout

commented 5 May 2022 at 09:17

Status:

Reviewed & tested by the community

» Needs work

The updates for phpstan (and phpstan-drupal) add new checks, and thus need an updated baseline.
Above patch will fail on a full phpstan run. (For D10 only that is).

See #3278916: Update phpstan/phpstan to latest version.

Might be easiest to leave the phpstan and phpstan-drupal out of this issue, and defer to the other one.
We should do #3259353: Run full phpstan on composer change (or even better #3259355: Always do a full phpstan analysis on DrupalCI)

Comment #12

longwave

he/him

English

commented 5 May 2022 at 09:24

Status:

Needs work

» Needs review

Status	File	Size
new	3278162-12-10.0.x.patch	74.69 KB

Rerolled 10.0.x patch with composer update --with=drupal/coder:8.3.13 --with=phpstan/phpstan:1.4.0 --with=mglaman/phpstan-drupal:1.1.9

+------------------------------------+---------+---------+
| Production Changes                 | From    | To      |
+------------------------------------+---------+---------+
| composer/installers                | v2.0.1  | v2.1.1  |
| composer/semver                    | 3.3.1   | 3.3.2   |
| doctrine/lexer                     | 1.2.2   | 1.2.3   |
| guzzlehttp/guzzle                  | 7.4.1   | 7.4.2   |
| symfony/console                    | v6.0.5  | v6.0.8  |
| symfony/dependency-injection       | v6.0.3  | v6.0.8  |
| symfony/deprecation-contracts      | v3.0.0  | v3.0.1  |
| symfony/error-handler              | v6.0.3  | v6.0.8  |
| symfony/event-dispatcher-contracts | v3.0.0  | v3.0.1  |
| symfony/http-foundation            | v6.0.3  | v6.0.8  |
| symfony/http-kernel                | v6.0.4  | v6.0.8  |
| symfony/mime                       | v6.0.3  | v6.0.8  |
| symfony/polyfill-iconv             | v1.24.0 | v1.25.0 |
| symfony/polyfill-intl-idn          | v1.24.0 | v1.25.0 |
| symfony/polyfill-php81             | v1.24.0 | v1.25.0 |
| symfony/process                    | v6.0.5  | v6.0.8  |
| symfony/routing                    | v6.0.3  | v6.0.8  |
| symfony/serializer                 | v6.0.3  | v6.0.8  |
| symfony/service-contracts          | v3.0.0  | v3.0.1  |
| symfony/string                     | v6.0.3  | v6.0.8  |
| symfony/translation-contracts      | v3.0.0  | v3.0.1  |
| symfony/validator                  | v6.0.3  | v6.0.8  |
| symfony/var-dumper                 | v6.0.3  | v6.0.8  |
| twig/twig                          | v3.3.8  | v3.3.10 |
+------------------------------------+---------+---------+

+------------------------------------+---------+---------+
| Dev Changes                        | From    | To      |
+------------------------------------+---------+---------+
| behat/mink-selenium2-driver        | v1.5.0  | v1.6.0  |
| doctrine/instantiator              | 1.4.0   | 1.4.1   |
| instaclick/php-webdriver           | 1.4.10  | 1.4.14  |
| justinrainbow/json-schema          | 5.2.11  | 5.2.12  |
| myclabs/deep-copy                  | 1.10.2  | 1.11.0  |
| phar-io/version                    | 3.1.0   | 3.2.1   |
| phpdocumentor/type-resolver        | 1.6.0   | 1.6.1   |
| phpunit/php-code-coverage          | 9.2.10  | 9.2.15  |
| phpunit/phpunit                    | 9.5.11  | 9.5.20  |
| sebastian/environment              | 5.1.3   | 5.1.4   |
| sebastian/global-state             | 5.0.3   | 5.0.5   |
| sebastian/type                     | 2.3.4   | 3.0.0   |
| seld/jsonlint                      | 1.8.3   | 1.9.0   |
| sirbrillig/phpcs-variable-analysis | v2.11.2 | v2.11.3 |
| symfony/dom-crawler                | v6.0.3  | v6.0.6  |
| symfony/filesystem                 | v6.0.6  | v6.0.7  |
| symfony/finder                     | v6.0.3  | v6.0.8  |
| symfony/lock                       | v6.0.3  | v6.0.7  |
| symfony/phpunit-bridge             | v6.0.3  | v6.0.8  |
+------------------------------------+---------+---------+

#8 is still valid for the 9.x patches.

Comment #13

5 May 2022 at 10:05

Status:

Needs review

» Needs work

The last submitted patch, 12: 3278162-12-10.0.x.patch, failed testing. View results

Comment #14

longwave

he/him

English

commented 5 May 2022 at 10:37

Status:

Needs work

» Needs review

Random fail in WidgetOEmbedTest

Comment #15

mallezie

Dutch

Loenhout

commented 6 May 2022 at 08:18

Status:

Needs review

» Reviewed & tested by the community

Looks good now to me.

Comment #16

longwave

he/him

English

commented 6 May 2022 at 08:44

Priority:

Major

» Critical

I think this is critical for 9.4.0-alpha1.

Comment #17

xjm

she/her

English

commented 6 May 2022 at 15:37

+++ b/composer/Metapackage/PinnedDevDependencies/composer.json
@@ -48,27 +48,27 @@
-        "sebastian/type": "2.3.4",
+        "sebastian/type": "3.0.0",

Major update here that seems to involve dropping PHP 7 support:

https://github.com/sebastianbergmann/type/commit/af0117b3c50858a8669027d...

We need to test these patches on PHP 7 too. I'll queue 'em.

Edit: I'm silly. That was the D10 patch. I thought it was the 9.4 one. Cancelling test runs.

Comment #18

longwave

he/him

English

commented 6 May 2022 at 15:40

Oops, didn't spot that one, but it's an indirect dependency of PHPUnit only, so I don't think it's an issue for us either. Drupal 10 only supports PHP 8.1, no need to queue PHP 7.x or even 8.0 tests there :)

Comment #19

xjm

she/her

English

commented 6 May 2022 at 15:42

Queued lower PHP runs for the right patches this time.

Comment #20

xjm

she/her

English

commented 6 May 2022 at 15:47

+++ b/composer/Metapackage/PinnedDevDependencies/composer.json
@@ -8,58 +8,58 @@
         "sebastian/type": "1.1.4",

Confirmed that it's not being updated in the 9.5.x patch.

Comment #21

xjm

she/her

English

commented 6 May 2022 at 15:50

We should document on https://www.drupal.org/about/core/policies/core-dependency-policies/mana... that the baseline needs to be updated (and how to do that) whenever phpstan is updated.

Comment #22

xjm

she/her

English

commented 6 May 2022 at 16:46

Issue summary:

View changes

OK, tests are green for the lower PHP versions on the 9.x branches.

Comment #23

6 May 2022 at 16:50

xjm committed 342ad34 on 10.0.x

Issue #3278162 by longwave, xjm, mallezie, Spokje: Update Composer...

Comment #24

6 May 2022 at 16:51

xjm committed 9cc4bbe on 9.5.x

Issue #3278162 by longwave, xjm, mallezie, Spokje: Update Composer...

Comment #25

6 May 2022 at 16:52

xjm committed aea299a on 9.4.x

Issue #3278162 by longwave, xjm, mallezie, Spokje: Update Composer...

Comment #26

xjm

she/her

English

commented 6 May 2022 at 16:52

Committed #12 to 10.0.x, and #8 to 9.5.x and 9.4.x. Thanks!

Comment #27

xjm

she/her

English

commented 6 May 2022 at 16:53

Status:	Reviewed & tested by the community	» Needs work
Issue tags:		+10.0.0 release notes, +9.4.0 release notes

Setting NW for the docs updates.

Comment #28

xjm

she/her

English

commented 6 May 2022 at 17:06

Oh we also need the followups for #3.

Comment #29

6 May 2022 at 17:06

Version:

9.4.x-dev

» 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.