- Issue created by @catch
- 🇬🇧United Kingdom catch
Duplicate of 📌 [policy] Patching dependencies Active
Drupal CMS currently includes automatic_updates module.
It's my understanding that someone should be able to install Drupal CMS, then use automatic_updates to update it from there onwards, whether attended or unattended, and give or take minor and major version updates of contrib and core at least in the short term.
However the project template also includes cweagans/composer-patches and various recipes include patches too.
package_manager includes ComposerPatchesValidator
* To ensure that applied patches remain consistent between the active and
* stage directories, the following rules are enforced if the patcher is
* installed:
* - It must be installed in both places, or in neither of them. It can't, for
* example, be installed in the active directory but not the stage directory
* (or vice versa).
* - It must be one of the project's direct runtime or dev dependencies.
* - It cannot be installed or removed by Package Manager. In other words, it
* must be added to the project at the command line by someone technical
* enough to install and configure it properly.
It is possible that package_manager won't choke on this validator because composer-patches is installed via the project template. However, even if this is the case, including it violates the spirit of that validator, because Drupal CMS is mainly designed for people who are not
someone technical enough to install and configure [composer patches] properly
- in fact they won't have installed it knowingly at all.
Automatic updates module cannot detect whether a patch has been fixed upstream, only that it no-longer applies, so as soon as a recipe is applied which includes a patch to core or a contrib module, it won't be possible to use automatic_updates to update that module, and further, the site owner would have to locate the patch, and figure out whether it's safe to remove or not, whether there's a new version of it etc., potentially without any git or composer experience at all.
Move the composer-patches plugin to a dev dependency and ensure that stable Drupal CMS versions don't apply any patches.
Active
General
Duplicate of 📌 [policy] Patching dependencies Active