Problem/Motivation

Found a couple of problems when reviewing #3133604: Dependency compatibility check in system doesn't check if version is defined

The bug was introduced probably in #474684: Allow themes to declare dependencies on modules

We don't check dependencies for themes is only modules. So for instances you can have a theme that has

base theme: classy
dependencies:
  - node
  - bootstrap

And we determine what a theme's module dependencies are in \Drupal\Core\Extension\ThemeExtensionList::doList()

      if (isset($theme->requires)) {
        $theme->module_dependencies = array_diff_key($theme->requires, $themes);
      }

Assuming that anything that isn't a theme is a module because sub themes, inherited from base theme, are added to $theme->requires

So this means in the above example if bootstrap is in the code base it will not be considered a module but if it is not then it will be considered a missing module.

So this module could be installed if bootstrap theme was in the code base but bootstrap would not be installed when installing this theme

So if the theme was then

base theme: classy
dependencies:
  - node
  - bootstrap (>8.x-9.x)

The ">8.x-9.x" would be ignored when installing it if bootstrap is in the code base because it is not a module. It is filtered out of $theme->module_dependencies

but then we get to system_requirements

// Check if the module exists.
        if (!isset($files[$required_module])) {

$files here actually is all themes and modules so then we actually do check if the version of bootstrap meets the constraint so you would get an error like

My theme requires this module and version. Currently using Bootstrap version 3.13

So installing would be ok but you get an error on the status report page or update.php

If a module has

type: module
dependencies:
  - node
  - bootstrap (>8.x-9.x)

bootstrap would be considered a missing module and you couldn't install your module
But if the module was installed and then - bootstrap (>8.x-9.x) was added in a update the version of bootstrap would be checked in system_requirements()

Proposed resolution

We should make sure that no current themes are in dependencies for other themes on install.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments

tedbow created an issue. See original summary.

tedbow’s picture

Priority: Normal » Major
tedbow’s picture

Title: Theme are allowed in 'dependencies' for other themes » Themes are allowed in 'dependencies' for other themes
Issue summary: View changes

Version: 9.0.x-dev » 9.1.x-dev

Drupal 9.0.10 was released on December 3, 2020 and is the final full bugfix release for the Drupal 9.0.x series. Drupal 9.0.x will not receive any further development aside from security fixes. Sites should update to Drupal 9.1.0 to continue receiving regular bugfixes.

Drupal-9-only bug reports should be targeted for the 9.1.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.2.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.1.x-dev » 9.3.x-dev

Drupal 9.1.10 (June 4, 2021) and Drupal 9.2.10 (November 24, 2021) were the last bugfix releases of those minor version series. Drupal 9 bug reports should be targeted for the 9.3.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

nicxvan’s picture

Status: Active » Postponed (maintainer needs more info)

Is this still an issue?
Can you write up a test?