Not really a bug but some solutions to possible gotcha on updating to Drupal 11.3.12 / 11.3.13.
These releases target security issues with Guzzle. Because the simplesamlphp package depends on this, it can cause some issues in updating to the new core version. Here are some things that will help:
First, you may get a lot of composer dependency problem messages on the standard update commands.
One cause of this is that your simplesamlphp library is dated (rc version in my case). Add the simplesamlphp/simplesamlphp to be updated with core. This will install the latest version that allow newer guzzle libraries and will resolve the dependency problem between core and simplesamlphp.
If you are using drupal/core-vendor-hardening, the new simplesamlphp code will cause a Symfony Directory not found exception to be thrown. This is because it removes translations required by SimpleSamlPhp. You can fix this by excluding the symfony/validator package from hardening. Do this, by adding the following section to your composer.json extra section:
"drupal-core-vendor-hardening": {
"symfony/validator": false
}
If you already updated before this, you can use the composer reinstall symfony/validator command to get the deleted directories back
Nothing here that the devs can fix. Just wanted to save others some headaches.
Comments
Comment #2
berdirYou should not need vendor-hardening unless you are using drupal-legacy project which you really shouldn't. vendor hardening is only required if your vendor folder is publicly accessible, which is very bad idea.