search

webflo / drupal-core-strict

27 stars 7 forks source link

Version 8.8.0 stable depends on "dev" dependencies of drupal/core et. al. #9

Open greg-1-anderson opened 4 years ago

greg-1-anderson commented 4 years ago

Previous versions did not require drupal/core at all. The 8.8.0 tag should depend on drupal/core 8.8.0 stable, not the 8.8.x-dev, and etc.

These errors cause confusion and force an upgrade to drupal/core-recommended. If the tag is not going to be fixed, it would probably be best to remove it. Having the tag would be helpful for folks who don't want to take the time to switch their composer.json around to use the new components yet.

greg-1-anderson commented 4 years ago

Upgrading is as easy as changing the required dependency from webflo/drupal-core-strict to drupal/core-recommended, so it might be reasonable to just abandon the tag here. Another alternative would be to just clone the contents of each tag in drupal/core-recommended here as they become available.

greg-1-anderson commented 4 years ago

Another thing you could do here is make webflo/drupal-core-strict require "drupal/core-recommended": "self.verson" and nothing else. Then all you would need to do is tag the same commit every time a new tag was pushed to drupal/core-recommended.

heddn commented 4 years ago

It would help if some of these discussions made it into the readme.md. Even if it is a link to this issue while we figure things out.

justin-schroeder commented 4 years ago

Thanks for detailing this @greg-1-anderson. Honestly I still don’t understand why the -dev constraint is on there. This caused some significant headaches. Was that (-dev) intentional? If not can someone help me understand what the purpose of this particular package is vs drupal/core-recommended? Thanks 👍

greg-1-anderson commented 4 years ago

webflo/drupal-core-strict is a community-provided project that has the same purpose as drupal/core-recommended, which is maintained on drupal.org. The former was created before the later existed. Only the later is now necessary.

The -dev dependency in 8.8.0+ is a bug. The only reason to fix it in this project is to help out existing sites based on drupal-composer/drupal-project that have not noticed / have not switched. There are probably still a lot of projects that can benefit. From those that have already discovered the problem, though, the easiest solution is to just switch to drupal/core-recommended.

sylus commented 4 years ago

Hi there I was hoping I could have some assistance :D

To support legacy packaging on top of my drush make I have always run (which would also fix projects on Drupal.org to support composer)

composer require 'j7mbo/twitter-api-php' 'league/oauth2-server:~6.0' 'webflo/drupal-core-strict:8.8.1' 'phpdocumentor/reflection-docblock:^3.0||^4.0'

But now all i get:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - The requested package drupal/core 1.0.0 exists as drupal/core[8.0.0, 8.0.0-beta10, 8.0.0-beta11, 8.0.0-beta12, 8.0.0-beta13, 8.0.0-beta14, 8.0.0-beta15, 8.0.0-beta16, 8.0.0-beta6, 8.0.0-beta7, 8.0.0-beta8, 8.0.0-beta9, 8.0.0-rc1, 8.0.0-rc2, 8.0.0-rc3, 8.0.0-rc4, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.x-dev, 8.1.0, 8.1.0-beta1, 8.1.0-beta2, 8.1.0-rc1, 8.1.1, 8.1.10, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.x-dev, 8.2.0, 8.2.0-beta1, 8.2.0-beta2, 8.2.0-beta3, 8.2.0-rc1, 8.2.0-rc2, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.x-dev, 8.3.0, 8.3.0-alpha1, 8.3.0-beta1, 8.3.0-rc1, 8.3.0-rc2, 8.3.1, 8.3.2, 8.3.3, 8.3.4, 8.3.5, 8.3.6, 8.3.7, 8.3.8, 8.3.9, 8.3.x-dev, 8.4.0, 8.4.0-alpha1, 8.4.0-beta1, 8.4.0-rc1, 8.4.0-rc2, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5, 8.4.6, 8.4.7, 8.4.8, 8.4.x-dev, 8.5.0, 8.5.0-alpha1, 8.5.0-beta1, 8.5.0-rc1, 8.5.1, 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 8.5.x-dev, 8.6.0, 8.6.0-alpha1, 8.6.0-beta1, 8.6.0-beta2, 8.6.0-rc1, 8.6.1, 8.6.10, 8.6.11, 8.6.12, 8.6.13, 8.6.14, 8.6.15, 8.6.16, 8.6.17, 8.6.18, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.6.9, 8.7.0, 8.7.0-alpha1, 8.7.0-alpha2, 8.7.0-beta1, 8.7.0-beta2, 8.7.0-rc1, 8.7.1, 8.7.10, 8.7.11, 8.7.2, 8.7.3, 8.7.4, 8.7.5, 8.7.6, 8.7.7, 8.7.8, 8.7.9, 8.7.x-dev, 8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.x-dev, 8.9.x-dev, 9.0.x-dev, dev-master] but these are rejected by your constraint.
  Problem 2
    - The requested package drupal/core-project-message 1.0.0 exists as drupal/core-project-message[8.8.0, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.x-dev, 8.9.x-dev, 9.0.x-dev, dev-master] but these are rejected by your constraint.
  Problem 3
    - The requested package drupal/core-vendor-hardening 1.0.0 exists as drupal/core-vendor-hardening[8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.x-dev, 8.9.x-dev, 9.0.x-dev, dev-master] but these are rejected by your constraint.
  Problem 4
    - paragonie/random_compat v9.99.99 requires php ^7 -> your PHP version (7.2.11) overridden by "config.platform.php" version (5.6) does not satisfy that requirement.
    - paragonie/random_compat v9.99.99 requires php ^7 -> your PHP version (7.2.11) overridden by "config.platform.php" version (5.6) does not satisfy that requirement.
    - Installation request for paragonie/random_compat (locked at v9.99.99) -> satisfiable by paragonie/random_compat[v9.99.99].

Installation failed, reverting ./composer.json to its original content.

This has always worked for the last 2-3 years. But now am unable to get a successful legacy packaging even though my regular composer workflow is fine.

I had a few questions was hoping could get help on? Greatly appreciated.

a) Why is the Drupal composer.json hardcoding the platform to 5.6 (this causes issue with composer) b) Why is composer.json using self.version with no version info.

zachomedia commented 4 years ago

Just following up on @sylus's message, but we were able to get it all working. The biggest issue was the composer.json file that was generated by Drupal containing incorrect settings that resulted in drupal/core 1.0.0 instead of 8.8.1.

Once that was resolved, switching from webflo/drupal-core-strict to drupal/core-recommended was as simple as mentioned above.

The last issue had to do with an old version of oauth2-server being acquired that didn't work on the newer PHP engines (which was compounded by the composer.json forcing composer to think it was on php 5.6). Upgrading that to 7.1 resolved it.