Contrib.social

composer install - library is not present in the lock file

Open on Drupal.org →
Created on 1 November 2023, about 1 year ago
Updated 5 April 2024, 7 months ago

Problem/Motivation

When installing webform 6.2.0 (over 6.1.5 if that matters) from lock file (when contrib modules are not in repo), composer refuses to install as some libraries are missing in lock file. e.g. Required package "ckeditor/autogrow" is not present in the lock file.

My theory so far is, that when libraries are managed by composer (as per https://www.drupal.org/node/3003140 → ), locally when performing update things go like this:

  1. composer require for new webform release updates module and thus composer.libraries.json
  2. it installs also libraries required in NEW composer.libraries.json thanks to wikimedia/composer-merge-plugin
  3. it writes NEW composer.lock file with all above installed

Then comes production with composer install - it first checks if composer.lock file is valid:

  1. composer.lock file is NEW, previously geneated locally
  2. composer.json is also NEW, but points to webform module's composer.libraries.json
  3. as this happens before actual install, webform module's (gitignored) composer.libraries.json is OLD
  4. boom: NEW compooser.lock is not valid against NEW composer.json + OLD composer.libraries.json

Resulting in:

$ composer2 install --no-dev
Gathering patches for root package.
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
- Required package "ckeditor/autogrow" is not present in the lock file.
- Required package "ckeditor/codemirror" is not present in the lock file.
- Required package "ckeditor/fakeobjects" is not present in the lock file.
- Required package "ckeditor/image" is not present in the lock file.
- Required package "ckeditor/link" is not present in the lock file.
- Required package "tippyjs/5.x" is not present in the lock file.
- Required package "tippyjs/6.x" is not present in the lock file.
This usually happens when composer files are incorrectly merged or the composer.json file is manually edited.

Please correct me if my assumption is wrong at any point. My theory is based on fact that when I manually replaced webform for new version (and composer.libraries.json by doing so), composer install works.

Steps to reproduce

  1. Install and deploy older webform (6.1.5) with libraries managed by composer with wikimedia/composer-merge-plugin ( https://www.drupal.org/node/3003140 → ) through repository with contrib modules ignored.
  2. composer require 'drupal/webform:^6.2' and verify it correctly installed updated libraries, updated composer.lock
  3. Try to composer install on machine where older webform is deployed.
  4. boom

Proposed resolution

No idea.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Closed: won't fix

Version

6.2

Component

Miscellaneous

Created by

t_d_d

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @t_d_d
  • Comment about 1 year ago →
    🇺🇸United States jrockowitz Brooklyn, NY

    You might have to remove the composer.libraries.json before updating and add back the reference.

  • Comment about 1 year ago →
    cilefen

    This seems approximately (maybe) https://github.com/wikimedia/composer-merge-plugin/issues/236. I don't know if anything can be done about this on the Webform side.

  • Comment about 1 year ago →
    t_d_d

    It really seems like something along #3:

    composer-merge-plugin is meant for projects that cannot ship their composer.lock...

    Anyway, I have just deployed on another machine and manually removing old webform module (folder) before composer install was enough for it to run smoothly. As it seems impossible to fix this, maybe we should document it on https://www.drupal.org/node/3003140 → like this (unless there is way to run composer install without validation of lock):

    Troubleshooting

    Failing composer install after webform update

    If your composer install fails after webform update with libraries missing in lock file, e.g.:

    Verifying lock file contents can be installed on current platform.
- Required package "xxx/yyy" is not present in the lock file.

    You may need to remove old webform module (just the folder) from the target machine before running composer install. See https://www.drupal.org/project/webform/issues/3398375 🐛 composer install - library is not present in the lock file Active .

  • Comment 12 months ago →
    🇩🇪Germany johnnny83

    I had the same problem with exactly the same libraries when running composer install (strangely only on of two Drupal installation which I thought were duplicates). Deleting composer.libraries.json and copying it back after composer install solved the problem for me.

  • Comment 12 months ago →
    🇺🇸United States jrockowitz Brooklyn, NY

    Painfully, there is nothing we can do because we can't tweak how composer and composer merge works.

    We might have to document the issue and process for updating the webform module from 6.1.x to 6.2.x on the project page and maybe the release notes.

    I am open to suggestions on what we should document.

  • Comment 12 months ago →
    🇺🇸United States jrockowitz Brooklyn, NY
  • Status changed to Closed: won't fix 7 months ago
  • Comment 7 months ago →
    🇺🇸United States jrockowitz Brooklyn, NY

    I have learned that composer merge does NOT work with Pantheon. I don't think there is any workaround.

    You will have to manually copy the composer.libraries.json information into your main composer.json.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024