Automated Drupal 10 compatibility fixes

@kreatIL, I understand. Let's see what direction the maintainers want to take it.

I have applied the patch from MR6 and for the most part, the upgrade status module is happy. It is dubious about the appearance of the file_create_url function, but the way @jrglasgow is using it seem merely to be for backwards-compatibility, not the de facto method of file upload. I'm inclined to say this is probably ready to go.

@loopy1492,
Actually the file_create_url() work you are talking about was done by Jaesin in this patch and it could be removed if we wanted to limit the compatibility to ^9.3 || ^ 10, since 8.x and 9.3.x are no longer supported versions of Drupal core I have no problem with that.

setting needs work to remove the file_url code mentioned

I added the #8's suggestion. Please review.

Looks good. Can we remove Drupal core from the composer.json file please? It's already listed in the .info file which is all Drupal cares about. Once Drupal 9.3 is end of life, we will need to edit the composer.json file to remove core to prevent security warnings and no one should be installing Drupal core by requiring the theme first, so we shouldn't encourage composer to install Drupal core that way.

@Greg Boggs I was looking at composer.json and I saw the seven dependency. What about it? It was removed from Drupal 10.

Looks good.

As far as the composer change suggested in #31, I think its fine the way it is. Its not a security problem to have an older version of the dependency in the list and listing your dependencies is how composer.json is suppose to work. I think the packaging script would generally take care of it but being explicit shouldn't be a bad thing.

re #32 The seven dependency is handled by contrib in 10 which is what the composer.json file is saying. https://drupal.org/project/seven

Adjusted a slight typo in core version requirement.

Was: core_version_requirement: ^9.3 || ^ 10

Now: core_version_requirement: ^9.3 || ^10

The explicit requirement for an old version of Drupal is a security vulnerability because that allows Drupal 9.0 to be installed which is end of life software. If you're going to specify drupal versions in composer.json, then you must keep that updated with each version of Drupal 9 that expires, so you're going to be committing to the file once per minor release. If you leave that out, then you can not update the composer file every couple of months.

And no one should ever install Drupal core by doing composer require drupal/adminimal and we should even make sure that doesn't work incase someone makes that mistake.

https://git.drupalcode.org/project/adminimal_theme/-/merge_requests/6/di...

Removing core requirement from composer.json, per #36.

The core requirement isn't _actually_ a security risk for 2 reasons.

1. Drupal 9 is explicitly supported for a while still
2. After it is no longer supported, it may still be supported by LTS vendors like 8 currently is for some people.
3. The || means there isn't an explicit _requirement, only noting it works with it.

That said, the change in #37 doesn't really matter because Drupal.org packaging will inject the core_version_requirements from the info into the composer file so its effectively the same now as it was before the change.

Still looks good to go.

Whatever the case, I'm glad for projects that are setting the core version requirements to some version of 9 in addition to 10. In preparation for the d10 upgrade, we are running through a d10 readiness story for ALL of our sites before actually making the move to d10. We cannot actually upgrade a few modules yet because the maintainers have decided to remove d9 from the picture entirely which is infuriating.

Hey Guys.
Proposed automated patch didn't completely covered all the theme compatibility. So I created my own one and would like to share it with you.
Good luck!

FWIW: We're using the latest MR in a Drupal 9.5.9 website with the Seven theme from contrib. Works as expected.

Patch in #40 isn't any different then the MR. Can we get it commit and a new D10 compat release tagged please? RTBC++

:pray:

Patch and MR are different actually.

MR includes changes for composer.json

  "require": {
      "drupal/seven": "~1.0"
  }

Instead, the patch contains some unrequired changes.

+1 RTBC for MR anyway.

Can someone merge the changes and make a version for Drupal 10?

Merged to 1.x-dev

Automatically closed - issue fixed for 2 weeks with no activity.