Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Problem/Motivation
There's a new SF version out.
Run composer update "symfony/*"
Drupal 9 should be handled by #3094007: Update the 9.0.x branch to Symfony 4.4-beta2 as that will require code changes due to new deprecations.
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
Drupal 8.8:
All Symfony dependencies have been updated to version 3.4.35
Drupal 8.7 and 8.6:
Symfony http-foundation has been updated to version 3.4.35
(maybe):
This includes an upstream security release which does not impact Drupal core.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 3094146-alt-8.7.x-4.patch | 7.42 KB | alexpott |
| #4 | 3094146-alt-8.6.x-4.patch | 7.53 KB | alexpott |
| #2 | 3094146-8.9.x-2.patch | 19.33 KB | alexpott |
| #2 | 3094146-8.8.x-2.patch | 19.33 KB | alexpott |
| #2 | 3094146-8.7.x-2.patch | 32.19 KB | alexpott |
Comments
Comment #2
alexpottOn Drupal 8.8 and 8.9 the changes are:
On Drupal 8.7.x the updates are:
On Drupal 8.6.x the changes are:
Comment #3
alexpottComment #4
alexpottHere's a more cautious approach for 8.6.x and 8.7.x if we want.
8.7.x
8.6.x
Comment #5
catchPrefer the patches in #4, we shouldn't update 8.6/8.7 any more than we need to, or at least not today.
I manually read through all the patches and they look fine. There's a new Symfony polyfill dependency in composer.lock - this is because it's a newly added dependency for http-kernel, so that change in composer.lock is legit.
Marking RTBC for the 8.6/8.7 patches in #4 and the 8.9 patch in #2. It would be great if someone else could +1 to allow me to commit (or of course another core committer is welcome to).
Comment #6
mikelutzThis makes sense, the metapackage changes appear to be correct for 8.8 and 8.9. I would go with the minimal approach for 8.6, and the fuller approach for 8.7, as it's technically still bugfix, and having it fully updated with Symfony as it goes into security next month will make addressing any other symfony security issues potentially easier over the next 6 months.
edit - @catch beat me to the RTBC, but +1, and I'm fine with the minimal approach for 8.7 too, that is an RM decision.
Comment #7
catchThis is potentially a good idea but I think we should open a follow-up to talk about that, since we may try to put out new 8.6/8.7 releases today which doesn't allow a lot of time to let the updates settle.
Comment #12
catchCommitted/pushed to 8.9.x, 8.8.x, 8.7.x, and 8.6.x, phew!
Also added a release notes snippet (which might need improving).
Comment #13
xjmComment #14
btriest CreditAttribution: btriest as a volunteer commentedThe release candidate (symfony 4 and 5) is released as of 17-11-2019. (rc-1).
https://symfony.com/blog/symfony-4-4-0-rc1-released
https://symfony.com/blog/symfony-5-0-0-rc1-released.
Is there a need to create a new issue?
Comment #15
gregglesRe #14: Drupal 8 is stable and does not include dramatic changes like a completely new symfony major release. Updating title to make that more clear, though likely it could be phrased even better.
Drupal 9, on the other hand, is the point to make a bump to the major version and it indeed has symfony 4, per #3009219: Update Symfony to 4.4 in Drupal 9.0 and more recently #3088369: Update Drupal 9 to Symfony 4.4-dev.
Comment #16
JeroenTFWIW, is there a possibility on automating this kind of updates? e.g. on Github you have https://dependabot.com/ which automates this kind of process.