Remove the unsupported ECA Helper module (SA-CONTRIB-2026-193)

Problem/Motivation

The Drupal Security Team marked ECA Helper unsupported (SA-CONTRIB-2026-193, CVE-2026-107250, 7 October 2026). Varbase Core requires drupal/eca_helper ~3 and installs it. Its only use is the eca_helper_http_request action in the managed "User login notification" ECA model (IP geolocation lookup).

Steps to reproduce

1. Install Varbase 10.1.x.
2. Check /admin/reports/updates: ECA Helper is reported as unsupported.

Proposed resolution

• Drop drupal/eca_helper from composer.json, the info.yml install list and .gitlab-ci-local.yml.
• Add a varbase_core_http_request ECA action that sets the same response token ([token:status], [token:client_error], [token:body], [token:json], [token:headers]), so models work unchanged. It accepts only http/https, always has a timeout, and drops free-form Guzzle options, multipart uploads and cookies.
• Switch the managed user_login model and its BPMN data model to it, with the modeler data hash recomputed.
• varbase_core_update_100002 converts every ECA model using eca_helper_http_request, then uninstalls ECA Helper when nothing else depends on it. If site models still use other ECA Helper plugins, it keeps it and tells the owner to composer require drupal/eca_helper.

Tested on Varbase 10.1.x (Drupal 11.4.9, ECA 3.1.9): updatedb converted the model, hash matches a fresh install, the modeler loads the diagram, ECA Helper uninstalled, the login notification email is still sent, file:// URLs are refused.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ❌ Automated unit/functional testing coverage
• ✅ Developer Documentation support on feature change/addition
  • Varbase Core (10.1.x): HTTP Request ECA Action and Updating From ECA Helper
• ➖ User Guide Documentation support on feature change/addition
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Code review from 1 Varbase core team member
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release
• ❌ Same change for the 10.0.x and 11.0.x lines
• ❌ Test the path where composer removed the ECA Helper code before updatedb
• ➖ Note: api.ipwho.org now answers 401 missing_api_key (pre-existing, location shows "No info")

User interface changes

N/A

API changes

New ECA action plugin varbase_core_http_request.

Data model changes

The managed user_login ECA model uses the new action; an update hook converts existing models.

Release notes snippet

Varbase Core no longer uses the unsupported ECA Helper module (SA-CONTRIB-2026-193). Updating moves the login notification model to a Varbase Core HTTP request action and uninstalls ECA Helper.