Better exposed filters noUiSlider library is not installed locally

Created on 13 December 2024, 4 months ago

Problem/Motivation

When you enable drupal_cms_blog or drupal_cms_news recipe, the better_exposed_filters module is installed. We are not adding the noUiSlider library locally, so the module will fetch the external library, which results in a warning in the status report:

BEF: library noUiSlider

Better exposed filters library noUiSlider is not installed locally and will be loaded from CDN. Loading external files from a CDN may be a data protection violation.
Please install the library. For more information see README.md

This can be an issue from the privacy point of view. However, the library is used only in case the Sliders BEF widget is used and such widget does not seems to be used in Drupal CMS by default.

I am not sure if it is better to include the library locally - just in case someone will enable the widget + to hide the warning (as it can give an impression that the library will be loaded actually), or do nothing (but the warning will be in the status report). Probably a question for @pameeela and/or @jurgenhaas.

Steps to reproduce

Install Drupal CMS with news or blog recipe
Go to status report
See that there is a warning about noUiSlider caused by the BEF module

Proposed resolution

TBD

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Active

Component

General

Created by

πŸ‡ΈπŸ‡°Slovakia poker10

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @poker10
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Including front-end libraries locally remains an unsolved problem. Webform suffers from it too.

  • πŸ‡¦πŸ‡ΊAustralia lxpcfly Canberra

    If you read the REAM.MD, it says

    "### Use a local version of the Slider library

    If you want to use a local library for the Slider functionality instead of loading the library from a CDN, you need to place the library in the `nouislider` directory of one of your Drupal installation's `libraries` folders.

    #### Project's composer.json and Drupal Core's Scaffolding plugin

    To set this up using Composer and [Drupal Core's Scaffolding plugin]( https://www.drupal.org/docs/develop/using-composer/using-drupals-compose... β†’ ), use the following commands:

    1. `composer config --json --merge extra.drupal-scaffold.file-mapping '{"[web-root]/libraries/nouislider/nouislider.min.js": "vendor/leongersen/nouislider/dist/nouislider.min.js"}'`
    2. `composer require -W 'leongersen/nouislider:15.5.1'`

    #### Using composer.libraries.json

    If you are using the Composer Merge Plugin you can add the composer.libraries.json to your project's composer.json:

    ```
    "merge-plugin": {
    "include": [
    "web/modules/contrib/better_exposed_filters/composer.libraries.json"
    ]
    }
    ```

    Then use the following command:

    `composer update -W 'leongersen/nouislider'`

    #### Install manually

    Alternatively, if you don't want to use Composer to manage the library, you could download the library from `https://cdnjs.cloudflare.com/ajax/libs/noUiSlider/15.5.1/nouislider.min.js` and place it into `libraries/nouislider` manually.

    Make sure to clear all caches for the changes to take effect.
    "

  • πŸ‡ΈπŸ‡°Slovakia poker10

    Yes, you can download a local copy of the library, but by default, it will use the CDN version, which can be problematic from the privacy point of view. Ideally, Drupal CMS should not use any external CDN resources by default / without consent, to comply with most privacy protection laws.

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    There is a solution path in the related issue at ✨ Create a mirror for external library dependencies for composer support Active and it looks that everybody agrees to that. So, I'll have a look and move this forward now, hoping that we get this in quickly before the code freeze of Drupal CMS.

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    The mirrored library is now available from https://www.drupal.org/project/nouislider_js β†’ and the BEF module now needs to add this as a requirement, then this issue should be resolved. Not sure if this one could be closed as there is nothing Drupal CMS needs to be doing to get this done.

  • πŸ‡ΊπŸ‡ΈUnited States darren oh Lakeland, Florida

    darren oh β†’ made their first commit to this issue’s fork.

  • πŸ‡ΊπŸ‡ΈUnited States darren oh Lakeland, Florida
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Let's scale this back. We should adjust the installer-paths in the project template, but I don't want to add actual library dependencies. That's up to the modules in question.

  • πŸ‡ΊπŸ‡ΈUnited States darren oh Lakeland, Florida

    The module in question left it up to the user's choice. This is an alternative solution if the maintainers decide it works as designed.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    OK - that makes sense and is in line with our focus on privacy. However, just for reference, is there an issue you could link to where it was decided to leave it to choice?

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    The issue ✨ Create a mirror for external library dependencies for composer support Active is already listed as a referenced issue and there the maintainers agreed to solve it in their module. At least that's how I understood their comment. So, I'm hopeful they will tag a patch release which contains this change.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    OK - if the maintainers are going to update their module, then we shouldn't.

    Let's get this done:

    • Let's get the installer-paths change done in this issue, since we'll need it anyway.
    • If BEF decides to make consumers choose the local library, then we'll do that in a follow-up.
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    I don't think we even need to do anything with the installer-paths. As stated in #6 there is a mirror of the library which provides that library as a type drupal-library. It can be required as drupal/nouislider and will already be installed in the correct directory.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    Oh, you're right - it's already in the project template. Silly me.

    I'll close this out for now, but let's reopen it if the BEF maintainers decide not to add the dependency.

Production build 0.71.5 2024