Require the vardot/ckeditor5-media-embed-drupal library at the GPL-licensed 47.6.2 that Drupal core 11.4 bundles

Problem/Motivation

Varbase 11 used to obtain six front-end libraries by running recipes/varbase_starter/scripts/drupal-libraries-sync.js, a Node script that copied files out of node_modules/ into web/libraries/, driven by a drupal-libraries block, six npm dependencies and a postinstall hook in package.json. That is replaced by Composer packages on Packagist, each required by the module or the varbase_* recipe that actually loads it.

• vardot/aos 2.3.4 (new)
• vardot/jquery.fancytree 2.38.5 (new)
• vardot/ckeditor5-media-embed-drupal 47.6.2 (new)
• vardot/ace 1.44.0 (refreshed from a 2017 fork)
• vardot/dropzone 5.9.3 (refreshed from a 2017 fork)
• swagger-api/swagger-ui, already required by drupal/openapi_ui_swagger; it only needed an installer path.

All are type: drupal-library except swagger-api/swagger-ui, which is type: library.

drupal/ckeditor_media_embed loads /libraries/ckeditor5/plugins/media-embed/build/media-embed.js. The module only suggests the library, because it spans Drupal core majors that bundle different CKEditor 5 versions and cannot pin one. This recipe pins drupal/core to ~11.4.0, one core minor and therefore one CKEditor 5 version, so it is the right place to carry the require.

Defect: licensing

The npm constraint "@ckeditor/ckeditor5-media-embed": "^47.6.0" was resolving to 47.7.2, which is the CKEditor 5 Long Term Support edition, commercial licence only with no GPL option, inside a GPL-2.0-or-later distribution. 47.6.2 is the last GPL dual-licensed release of that line, and it is exactly what Drupal 11.4 core bundles. A CKEditor 5 plugin must match core's CKEditor 5 version or the editor fails with ckeditor-duplicated-modules.

~47.6.2 also cannot drift into the commercial 47.7.x LTS line.

The require belongs in the recipe rather than in the module because the consuming module does not require the library itself: without this line the recipe installs a module whose front-end asset never arrives.

For contrast, no recipe line was added where a module does require its own library (drupal/anchor_link with vardot/ckeditor5-anchor-drupal, drupal/better_exposed_filters with drupal/nouislider_js, drupal/yoast_seo with goalgorilla/rtseo.js, drupal/klaro with drupal/klaro_js, drupal/openapi_ui_swagger with swagger-api/swagger-ui). That is deliberate, so there is one place to bump per library and no recipe pin can later block a module upgrade.

Steps to reproduce

1. Apply the Varbase Editor Base recipe on a fresh Varbase 11.4.5 site.
2. Look for /libraries/ckeditor5/plugins/media-embed/build/media-embed.js in web/libraries/: absent, unless the project's drupal-libraries-sync Node script copied it out of node_modules/.
3. The front-end asset the module declares never arrives.

Environment: Drupal core 11.4.5, Varbase 11.0.x, PHP 8.4, MariaDB, DDEV.

Proposed resolution

• composer.json: require vardot/ckeditor5-media-embed-drupal: ~47.6.2.

Verified on a freshly installed Varbase 11.4.5 site in DDEV, with every package resolved from Packagist and no VCS repositories:

• 14/14 declared library files present on disk; 10/10 assets return HTTP 200.
• 7/7 Drupal libraries discovered, every asset resolving, all 7 rendering the Composer paths.
• Status report green: ace_editor OK, dropzonejs_library OK, taxonomy_manager OK, media-embed installed at 47.6.2 matching core 47.6.2.
• ace_editor PHPUnit: 69 tests, 709 assertions, 0 failures. phpcs clean on every changed PHP file.
• yarn install succeeds with none of the six npm library packages present.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• The recipe now requires vardot/ckeditor5-media-embed-drupal at ~47.6.2, matching the CKEditor 5 that Drupal core 11.4 bundles and staying on the GPL dual-licensed line.