I am aware that my choice of category/priority will be controversial and may get changed. However I honestly believe these values reflect the status for many users. The long established option of "drush pm-upgrade" is only barely working in D8.4: #2906637: [META] Drush and core compatibility is fragile. Please lets work together to make constructive progress rather than just criticising this issue (feel free to edit!)

The options that we have:

Drush

  • Has worked well for many users but increasing complications with dependency clashes mean this will not be a viable option for much longer.
  • Does not install dependent libraries or tools. For example the address module requires composer.

Drupal GUI

By hand

  • Download, extract and copy files by hand is tedious and error-prone. In 2017 surely you are joking.
  • Not really documented how to install dependent libraries or tools.

Composer
There has been a lot of work to make this usable for those comfortable with development and solving a few little problems as they go. However it is far from out of the box.

Comments

AdamPS created an issue. See original summary.

rachel_norfolk’s picture

rachel_norfolk
Primary language English
Location UK
CreditAttribution: rachel_norfolk at Open Development Ltd for Horizons Unlimited commented

It may be worth catching up with Bojan as he has been working on a tool to make it easier to install commerce 2 without needing composer. It looks like really good work and may be relevant.

Mile23’s picture

Mile23
Primary language English
Location Seattle, WA
CreditAttribution: Mile23 as a volunteer commented
Related issues: +#2002304: [META] Improve Drupal's use of Composer

Drupal tarball does not ship with composer nor leave a deployment composer-ready.

Drupal tarball is built using composer install --no-dev. It does not include the Composer binary for a lot of good reasons. We don't include the composer/composer package for a lot of other good reasons.

Some of the reasons are:

  • Security.
  • Security.
  • Memory hog.
  • Security.
  • Dependency resolution time is very much probably going to exceed HTTP request timeout.
  • Security.

As far as I know Drupal core does not include a component "composer" and hence a maintainer nor are there any tests.

There is a Composer test group. Also, all testbot builds are assembled via d.o's Composer façade.

There is a composer tag, and at least this one meta: #2002304: [META] Improve Drupal's use of Composer

AdamPS’s picture

AdamPS CreditAttribution: AdamPS at AlbanyWeb commented
Status: Active » Closed (works as designed)

Thanks for the comments.

Good news is that further investigation (see #2906637: [META] Drush and core compatibility is fragile) has determined "drush pm-update D8.4" does work with perhaps a minor glitch. Hence the scenario described in this issue "lost any satisfactory upgrade" is not true for D8.4, and I will close this issue.

This scenario is still a real risk for the future. However there are other issues for that: plenty of issues for "improve composer", and the referenced issue is a task to keep pm-update working in the meantime.