Problem/Motivation

tl;dr: Not only does Pathauto require Ctools despite not actually depending on it, it provides a workaround that's not appropriate for project templates like Starshot. A different solution would be preferable.

I'm not the first person (or the seventh) to point out that Pathauto declares a Composer dependency on Ctools even though it doesn't use it at all. (See previous issues below.) And I realize a workaround has been provided. But that workaround, involving the use of Composer's replace feature, is not appropriate for project templates where making that decision for users ahead of time would result in a very confusing situation if they ever try to composer require drupal/ctools and it does nothing. This is especially true for Starshot, which will be the recommended starting point for all new sites, and by extension a lot of users who 1) don't want unused code in production and 2) aren't necessarily experienced with Composer.

Downstream issue in Starshot

Track upstream issue for unused Pathauto dependency on Ctools · Issue #103 · phenaproxima/starshot-prototype

Previous issues

Proposed resolution

The most obvious solution would probably be to remove the dependency and bump the module version. It probably wouldn't be a bad time to move to semver anyway. If not, and your still worried about the undeclared dependency problem, perhaps you could remove the dependency and use a message in an update hook and/or admin notice.

Remaining tasks

Comments

TravisCarden created an issue. See original summary.

traviscarden’s picture

traviscarden commented
Issue summary: View changes
traviscarden’s picture

traviscarden commented
Issue summary: View changes
ressa’s picture

ressa
he/him
commented

Thanks for pursuing this @TravisCarden. Streamlining the Starshot experience is a great incentive to getting the Ctools module issue sorted out, and removed from Pathauto.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Active » Postponed

Having a module in the code base that's not enabled is a minor annoyance at best, you'll have plenty of non-enabled modules in the code base.

Some of the previous issues are the ones where the actual work happened, yes, there have been 4-5 issues asking about this, but nothing was broken due to that, it's just low prio questions. Removing it is likely going to confuse dozens to hundreds of less experienced users that will get actual warnings and problems when upgrading. Pathauto has 300k installations on D8, and getting such an issue every few months is a price I'm happy to pay to avoid the alternative scenario.

Yes, a 2.x release will then remove it, but I have no plans to create that any time soon and I won't do it only for that. ctools is still actively maintained and has a D11 compatible stable release already, so it doesn't block D11 adoption either. If that ever changes then I might push for the removal to happen but until then, this likely won't happen.

traviscarden’s picture

traviscarden commented

Thanks, @Berdir. Your position is perfectly understandable. I will share as a matter of documentation, that the biggest reason I care about unused code in production is that I've had to rush deployments before for security vulnerabilities in modules I wasn't using and didn't have installed, and that, of course, is a risk a prefer to avoid. But as I say, I respect your position, and I thank you for your work on such a critical module. 🙂

anthonytm’s picture

anthonytm commented

For folks stumbling across this issue, there is a simple fix until the next major version is released. If you are sure you do not need ctools in your project, simply add the following replace in your project composer.json file:

"replace": {
    "drupal/ctools": "*"
}

That will fully remove ctools. Again, make sure you aren't using for anything else. This solution is provided in the release notes that are referenced on the main project page.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Just ran into this and looking forward to a 2.x release in the future without the old ctools dependency in composer, which is indeed also confusing.

mably’s picture

mably commented
Issue summary: View changes
romulasry’s picture

romulasry commented

Update?

o'briat’s picture

o'briat
Primary language French
Location Nantes
commented

I understand Berdir concerns, but peoples using ctools without specifically require it should be noticed or nothing will never change.

Why not using the hook_requirement s to do it (there's maybe better way? Via composer?):

/**
 * Implements hook_requirements().
 */
function pathauto_requirements($phase) {
  $requirements = [];

  if ($phase === 'runtime' && Drupal::moduleHandler()->moduleExists('ctools')) {
    $requirements['pathauto_deprecate_ctools'] = [
      'severity' => REQUIREMENT_WARNING,
      'title' => t('Deprecated dependency: Ctools'),
      'description' => t('Pathauto 2.0 will <strong>stop</strong> to include the Ctools module. Please add it to your project directly: composer require &#039;drupal/ctools:^3.15&#039; or composer require &#039;drupal/ctools:^4.1&#039;.'),
    ];
  }
  return $requirements;
}

A check of the composer.json could be added to avoid false positif