Problem/Motivation

Drupal CMS out of the box includes a large number of modules that are not enabled by the base recipe. These will be on the filesystem of sites that install Drupal CMS without being installed - until a recipe that depends on them is installed.

If these modules are installed later without being updated in the meantime, there are two potential negative consequences:

1. If the module has had a security release, site owners will start getting a notification that the module is insecure after they've installed it (and made their site insecure), not before.

2. If the module has had new releases with database updates included, the site owner will get a notification that a newer version is available after they install it, and then the module's updates will need to be run. If they update it before installing, no updates to run which is a lot more reliable and less error prone.

Steps to reproduce

Proposed resolution

Set update.settings:check.disabled_extensions to TRUE in the base recipe.

I'll open a core issue to flip the default in update module too, but that can only be changed in a minor release of core.

User interface changes

Data model changes

Issue fork drupal_cms-3510973

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

catch created an issue. See original summary.

phenaproxima’s picture

phenaproxima
he/him
Primary language English
Location Massachusetts
commented

This seems like a sensible enough change to me.

catch’s picture

catch
he/him
Primary language English
commented
Related issues: +#3510976: Check update status for uninstalled extensions by default
catch’s picture

catch
he/him
Primary language English
commented
Issue summary: View changes
catch’s picture

catch
he/him
Primary language English
commented

Another benefit here is that is that if it helps site owners keep modules up to date, it should mean less of a backlog when checking Drupal 12 compatibility when the time comes. Composer doesn't distinguish between installed and uninstalled modules so will happily block a major update on something that's not actually in use. At least if everything's up-to-date, or obviously not up-to-date, then it gives the site owner more of a hint on what next steps are.

thejimbirch made their first commit to this issue’s fork.

thejimbirch opened merge request !523

thejimbirch’s picture

thejimbirch commented
Status: Active » Needs review

MR added.

catch’s picture

catch
he/him
Primary language English
commented

Looks good to me.

thejimbirch’s picture

thejimbirch commented
Status: Needs review » Needs work

Tests are failing, moving back to needs work. 

[config][actions][update.settings]: Config actions cannot be applied to u  
  pdate.settings because the update extension is not installed, and is not in  
  stalled by this recipe or any of the recipes it depends on.

Interesting. I just installed Drupal CMS with only the base recipe and Update was enabled, so I am wondering where it came from.

thejimbirch’s picture

thejimbirch commented

drupal_cms_starter requires the automatic_updates module that requires update. Looks like the test/validation doesn't go that deep. I will explicitly add it to be installed.

thejimbirch’s picture

thejimbirch commented
Status: Needs work » Needs review
dww’s picture

dww
we/he/they
commented

LGTM, but I haven't directly contributed to Drupal CMS config / recipes yet, so I don't feel super qualified to RTBC this.

Only question is if this will still work if the default in core changes, too: #3510976: Check update status for uninstalled extensions by default

phenaproxima’s picture

phenaproxima
he/him
Primary language English
Location Massachusetts
commented
Status: Needs review » Reviewed & tested by the community

Yes, it will work if the default changes. Config actions always do what they say they'll do, regardless of what the config might already be.

phenaproxima’s picture

phenaproxima
he/him
Primary language English
Location Massachusetts
commented
Status: Reviewed & tested by the community » Fixed

Merged into 1.x, thanks! In the name of caution, not backporting to 1.0.x, but I can be persuaded if there's a strong case for it in the near term.

dww’s picture

dww
we/he/they
commented

Groovy, thanks!

phenaproxima’s picture

phenaproxima
he/him
Primary language English
Location Massachusetts
commented
Status: Fixed » Needs work
Issue tags: +Needs change record

I think we'll want a change record for this.

phenaproxima’s picture

phenaproxima
he/him
Primary language English
Location Massachusetts
commented
Issue tags: -Needs change record +Needs change record updates

Created the change record, it just needs details filled in. https://git.drupalcode.org/project/drupal_cms/-/wikis/Committer-Info/Cha... can be used as a template.

pameeela’s picture

pameeela commented
Status: Needs work » Fixed
Issue tags: -Needs change record updates

Filled in CR.

pameeela’s picture

pameeela commented

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.