cmc333333
commented
6 years ago Hey there, @fureigh!
- composer.json didn't need to be modified; it's set to
~8.5, which means anything >=8.5 but less than 8.6. The composer file is meant to describe compatible versions rather than exact versions, which is why the lock file is separate; when we runcompose updatewe get the latest version that's still compatible. In this case I needed to update the three symfony libraries prior todrupal/core, but composer.json wasn't modified. - The trailing slash remove came from Drupal core, which has hooks to modify these when it's installed. One of the patch releases since 8.5.3 must have modified the auto-generated template; seems likely they fixed a bug we weren't having.
fureigh
Drupal core issued a security release today that bumps up their dependent libraries: https://www.drupal.org/SA-CORE-2018-005
To satisfy, this updates Drupal and three of the symfony libraries it depends on. In one of the patch releases sine 8.5.3, Drupal also modified two of the files it auto-creates; we've included those changes here as well.