Remove JS Cookie dependency

MR created
This probably deserves a mention in the release note that the dependency on js_cookie module was removed and sites can uninstall it themselves if unused.

Added a query

I’ve tested MR!83 with version 2.0.1 on drupal/core 11.2.x and can confirm that it works as expected. After disabling and removing the js_cookie dependency from my project, the logout functionality continues to work correctly.

One remaining concern is the sameSite attribute. In the js-cookie library, the default value for sameSite is not set, so explicitly setting it to lax would change the current behavior. See: https://github.com/js-cookie/js-cookie?tab=readme-ov-file#samesite

Because of this potential behavior change, I’m leaving my review status at Needs review for now. Without the sameSite consideration, this would be RTBC from my side.

The patch includes a snapshot of the current state of the MR and can be safely applied using composer-patches.

Happy not to bikeshed this over the sameSite value. Lax is the default for most browsers in any case.

Any plans to merge this? Looking at the MANY maintainers, it might be a good time to clean up inactive ones, also for security reasons?

I have outlined the path to a new version in #3390554: [META] Roadmap to new release before releasing a new version.

While I could just start merging, I would prefer #3339695: Use Drupal.dialog call instead of jQuery dialog to go in first and clear the way for all the other tickets outlined in the ticket above.

Merged

For the love of god do not remove module dependencies in minor versions. We have deployed the security update to our test environment and now Drupal is going on and on about the missing the js_cookie module that is still enabled, and now we need to add it as a composer dependency just so we can cleanly disable the module in live on deploy.

At the very least mention the removal in the release notes https://www.drupal.org/project/autologout/releases/2.0.2

Same here, the workaround:

drush state:set system.maintenance_mode 1
drush cr
composer update drupal/autologout --with-all-dependencies
composer require 'drupal/js_cookie:^1.0'
drush cr
drush updb
drush pmu js_cookie
composer remove drupal/js_cookie
drush state:set system.maintenance_mode 0
drush cr

Apologies, in hindsight, this should have been a major verison release.

I’m wondering why the hook update to install js_cookie is still present. I’m updating the module from 1.4.0 to 1.7.0 and encountered an error when running database updates.

This #3580316: autologout_update_9201 fails with "Unable to install modules js_cookie" after js_cookie dependency was removed was created to address the hook update removal.