Upgrade to Drupal 8.8

wolcen commented

2020-03-19 05:20:57 +00:00

(Migrated from gitlab.com)

Background

Upgrade to Drupal 8.8

This was undertaken as a result of SA-CORE-2020-001, but note the site is currently at Drupal 8.7.12, which has fixed that bug.

Work Required

composer update
deploy to test with drutopia hosting
deploy to live with drutopia hosting

## Background Upgrade to Drupal 8.8 This was undertaken as a result of SA-CORE-2020-001, but note the site is currently at Drupal 8.7.12, which has fixed that bug. ## Work Required - [x] composer update - [x] deploy to test with drutopia hosting - [x] deploy to live with drutopia hosting

wolcen commented

2020-03-19 05:23:08 +00:00

(Migrated from gitlab.com)

changed the description

wolcen commented

2020-03-19 06:37:31 +00:00

(Migrated from gitlab.com)

In attempting a composer update (after rm -rf vendor):

There is an error applying a patch:

  - Applying patches for drupal/search_api
    https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch (Notice: Undefined index: total When we enable the module in the installation step)
   Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch

And the following suggestions:

pear/archive_tar suggests installing ext-xz (Lzma2 compression support.)
paragonie/random_compat suggests installing ext-libsodium (Provides a modern crypto API that can be used to generate random bytes.)
symfony/http-kernel suggests installing symfony/browser-kit
symfony/http-kernel suggests installing symfony/config
symfony/routing suggests installing symfony/config (For using the all-in-one router or any loader)
symfony/routing suggests installing symfony/expression-language (For using expression matching)
guzzlehttp/psr7 suggests installing zendframework/zend-httphandlerrunner (Emit PSR-7 responses)
symfony/psr-http-message-bridge suggests installing nyholm/psr7 (For a super lightweight PSR-7/17 implementation)
symfony/class-loader suggests installing symfony/polyfill-apcu (For using ApcClassLoader on HHVM)
zendframework/zend-feed suggests installing zendframework/zend-cache (Zend\Cache component, for optionally caching feeds between requests)
zendframework/zend-feed suggests installing zendframework/zend-db (Zend\Db component, for use with PubSubHubbub)
zendframework/zend-feed suggests installing zendframework/zend-http (Zend\Http for PubSubHubbub, and optionally for use with Zend\Feed\Reader)
zendframework/zend-feed suggests installing zendframework/zend-servicemanager (Zend\ServiceManager component, for easily extending ExtensionManager implementations)
zendframework/zend-feed suggests installing zendframework/zend-validator (Zend\Validator component, for validating email addresses used in Atom feeds and entries when using the Writer subcomponent)
easyrdf/easyrdf suggests installing ml/json-ld (~1.0)
doctrine/cache suggests installing alcaeus/mongo-php-adapter (Required to use legacy MongoDB driver)
symfony/translation suggests installing symfony/config
symfony/validator suggests installing psr/cache-implementation (For using the metadata cache.)
symfony/validator suggests installing symfony/intl
symfony/validator suggests installing symfony/config 
symfony/validator suggests installing symfony/property-access (For accessing properties within comparison constraints)
symfony/validator suggests installing symfony/expression-language (For using the Expression validator)
symfony/serializer suggests installing psr/cache-implementation (For using the metadata cache.)
symfony/serializer suggests installing symfony/property-info (To deserialize relations.)
symfony/serializer suggests installing symfony/config (For using the XML mapping loader.)
symfony/serializer suggests installing symfony/property-access (For using the ObjectNormalizer.)
symfony/dependency-injection suggests installing symfony/config
symfony/dependency-injection suggests installing symfony/expression-language (For using expressions in service container configuration)
symfony/dependency-injection suggests installing symfony/proxy-manager-bridge (Generate service proxies to lazy load them)
symfony/console suggests installing symfony/lock
drupal/paragraphs suggests installing drupal/entity_browser (Recommended for an improved user experience when using the Paragraphs library module)
drupal/search_api suggests installing drupal/search_api_autocomplete (Allows adding autocomplete suggestions to search fields.)
drupal/search_api suggests installing drupal/search_api_solr (Adds support for using Apache Solr as a backend.)
drupal/migrate_plus suggests installing sainsburys/guzzle-oauth2-plugin (3.0 required for the OAuth2 authentication plugin)
consolidation/robo suggests installing henrikbjorn/lurker (For monitoring filesystem changes in taskWatch)
consolidation/robo suggests installing patchwork/jsqueeze (For minifying JS files in taskMinify)
consolidation/robo suggests installing natxet/CssMin (For minifying CSS files in taskMinify)
psy/psysh suggests installing ext-pdo-sqlite (The doc command requires SQLite to work.)
psy/psysh suggests installing hoa/console (A pure PHP readline implementation. You'll want this if your PHP install doesn't already support readline or libedit.)
drupal/config_filter suggests installing drupal/config_split (Split site configuration for different environments.)

And the following deprecations:

Package zendframework/zend-diactoros is abandoned, you should avoid using it. Use laminas/laminas-diactoros instead.
Package zendframework/zend-stdlib is abandoned, you should avoid using it. Use laminas/laminas-stdlib instead.
Package zendframework/zend-escaper is abandoned, you should avoid using it. Use laminas/laminas-escaper instead.
Package zendframework/zend-feed is abandoned, you should avoid using it. Use laminas/laminas-feed instead.
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.

The phar-stream-wrapper v2 is required, but v3 is recommended at https://github.com/TYPO3/phar-stream-wrapper for PHP 7.x:

ddev . composer prohibits drupal/core:8.8

drupal/core       8.8.0       requires          typo3/phar-stream-wrapper (^3.1.3)                   
agaric-sites/geo  dev-master  does not require  typo3/phar-stream-wrapper (but v2.1.4 is installed)

Attempting to update:

ddev . composer require typo3/phar-stream-wrapper ^3.0
./composer.json has been updated
Gathering patches for root package.
Removing package drupal/search_api so that it can be re-installed and re-patched.
  - Removing drupal/search_api (1.15.0)
Deleting web/modules/contrib/search_api - deleted
Loading composer repositories with package information
Updating dependencies (including require-dev)         
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Installation request for typo3/phar-stream-wrapper ^3.0 -> satisfiable by typo3/phar-stream-wrapper[3.x-dev, v3.0.0, v3.0.1, v3.1.0, v3.1.1, v3.1.2, v3.1.3, v3.1.4].
    - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev].
    - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev].
    - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev].
    - Conclusion: don't install typo3/phar-stream-wrapper v2.x-dev
    - Installation request for drupal/core (locked at 8.7.12) -> satisfiable by drupal/core[8.7.12].


Installation failed, reverting ./composer.json to its original content.

typo3+drupal 8.8:

 ddev . composer require typo3/phar-stream-wrapper ^3.0 drupal/core ^8.8                                                                                                                      
No composer.json in current directory, do you want to use the one at /var/www/html? [Y,n]?                                                                                                                         
GitHub API limit (60 calls/hr) is exhausted, could not fetch https://api.github.com/repos/drutopia/drutopia/tags?per_page=100. Create a GitHub OAuth token to go over the API rate limit. You can also wait until $
020-03-19 06:09:15 for the rate limit to reset.                                                                                                                                                                    
                                                                                                                                                                                                                   
Head to https://github.com/settings/tokens/new?scopes=repo&description=Composer+on+geo-web+2020-03-19+0542                                                   
to retrieve a token. It will be stored in "/home/wolcen/.composer/auth.json" for future use by Composer.                                                                                                           
Token (hidden):                                                                                                                                                                                                    
Token stored successfully.                                                                                                                                                                                         
./composer.json has been updated                                                                                                                                                                                   
Gathering patches for root package.                                                                                                                                                                                
Loading composer repositories with package information                                                                                                                                                             
Updating dependencies (including require-dev)                                                                                                                                                                      
Your requirements could not be resolved to an installable set of packages.                                                                                                                                         
                                                                                                                                                                                                                   
  Problem 1                                                                                                                                                                                                        
    - Conclusion: remove drupal/claro 1.0.0-beta1                                                                                                                                                                  
    - Conclusion: don't install drupal/claro 1.0.0-beta1                                                                                                                                                           
    - don't install drupal/core 8.8.x-dev|don't install drupal/claro 1.0.0-beta1                                                                                                                                   
    - don't install drupal/core 8.9.x-dev|don't install drupal/claro 1.0.0-beta1                                                                                                                                   
    - don't install drupal/core 8.8.0|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.0-alpha1|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.0-beta1|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.0-rc1|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.1|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.2|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.3|don't install drupal/claro 1.0.0-beta1
    - don't install drupal/core 8.8.4|don't install drupal/claro 1.0.0-beta1
    - Installation request for drupal/claro (locked at 1.0.0-beta1, required as ^1.0@alpha) -> satisfiable by drupal/claro[1.0.0-beta1].
    - Installation request for drupal/core ^8.8 -> satisfiable by drupal/core[8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.8.x-dev, 8.9.x-dev].


Installation failed, reverting ./composer.json to its original content.
Failed to execute command composer require typo3/phar-stream-wrapper ^3.0 drupal/core ^8.8: exit status 2

remove drupal/claro (expecting it to be included by drupal 8.8):

ddev . composer remove drupal/claro                                                               
No composer.json in current directory, do you want to use the one at /var/www/html? [Y,n]? 
Gathering patches for root package.
Loading composer repositories with package information
Updating dependencies (including require-dev)          
Package operations: 1 install, 2 updates, 2 removals 
  - Removing brumann/polyfill-unserialize (v1.0.4)
  - Removing drupal/core (8.7.12)
Deleting web/core - deleted
Gathering patches for root package.
Gathering patches for dependencies. This might take a minute.
  - Updating typo3/phar-stream-wrapper (v2.1.4 => v3.1.4): Downloading (100%)         
  - Removing drupal/claro (1.0.0-beta1)
Deleting web/themes/contrib/claro - deleted
  - Installing drupal/core (8.8.4): Downloading (100%)         
  - Applying patches for drupal/core
    https://www.drupal.org/files/issues/2018-11-27/2982052-22.patch (Allow an install hook in profiles installing from configuration)
   Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2018-11-27/2982052-22.patch

  - Installing drupal/search_api (1.15.0): Loading from cache
  - Applying patches for drupal/search_api
    https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch (Notice: Undefined index: total When we enable the module in the installation step)
   Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch

Here, Drupal 8.8 will now installs!

However, need to research patches, replace deprecated dependencies. I believe drupal/claro is included in core (exists in web/core/themes/claro/), so that's set, right?

Patch issues:

https://www.drupal.org/project/drupal/issues/2982052 (unclear to me what patch to use here)
https://www.drupal.org/project/search_api/issues/2931562 - CLOSED/we can remove this patch.

In attempting a `composer update` (after `rm -rf vendor`): There is an error applying a patch: ``` - Applying patches for drupal/search_api https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch (Notice: Undefined index: total When we enable the module in the installation step) Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch ``` And the following suggestions: ``` pear/archive_tar suggests installing ext-xz (Lzma2 compression support.) paragonie/random_compat suggests installing ext-libsodium (Provides a modern crypto API that can be used to generate random bytes.) symfony/http-kernel suggests installing symfony/browser-kit symfony/http-kernel suggests installing symfony/config symfony/routing suggests installing symfony/config (For using the all-in-one router or any loader) symfony/routing suggests installing symfony/expression-language (For using expression matching) guzzlehttp/psr7 suggests installing zendframework/zend-httphandlerrunner (Emit PSR-7 responses) symfony/psr-http-message-bridge suggests installing nyholm/psr7 (For a super lightweight PSR-7/17 implementation) symfony/class-loader suggests installing symfony/polyfill-apcu (For using ApcClassLoader on HHVM) zendframework/zend-feed suggests installing zendframework/zend-cache (Zend\Cache component, for optionally caching feeds between requests) zendframework/zend-feed suggests installing zendframework/zend-db (Zend\Db component, for use with PubSubHubbub) zendframework/zend-feed suggests installing zendframework/zend-http (Zend\Http for PubSubHubbub, and optionally for use with Zend\Feed\Reader) zendframework/zend-feed suggests installing zendframework/zend-servicemanager (Zend\ServiceManager component, for easily extending ExtensionManager implementations) zendframework/zend-feed suggests installing zendframework/zend-validator (Zend\Validator component, for validating email addresses used in Atom feeds and entries when using the Writer subcomponent) easyrdf/easyrdf suggests installing ml/json-ld (~1.0) doctrine/cache suggests installing alcaeus/mongo-php-adapter (Required to use legacy MongoDB driver) symfony/translation suggests installing symfony/config symfony/validator suggests installing psr/cache-implementation (For using the metadata cache.) symfony/validator suggests installing symfony/intl symfony/validator suggests installing symfony/config symfony/validator suggests installing symfony/property-access (For accessing properties within comparison constraints) symfony/validator suggests installing symfony/expression-language (For using the Expression validator) symfony/serializer suggests installing psr/cache-implementation (For using the metadata cache.) symfony/serializer suggests installing symfony/property-info (To deserialize relations.) symfony/serializer suggests installing symfony/config (For using the XML mapping loader.) symfony/serializer suggests installing symfony/property-access (For using the ObjectNormalizer.) symfony/dependency-injection suggests installing symfony/config symfony/dependency-injection suggests installing symfony/expression-language (For using expressions in service container configuration) symfony/dependency-injection suggests installing symfony/proxy-manager-bridge (Generate service proxies to lazy load them) symfony/console suggests installing symfony/lock drupal/paragraphs suggests installing drupal/entity_browser (Recommended for an improved user experience when using the Paragraphs library module) drupal/search_api suggests installing drupal/search_api_autocomplete (Allows adding autocomplete suggestions to search fields.) drupal/search_api suggests installing drupal/search_api_solr (Adds support for using Apache Solr as a backend.) drupal/migrate_plus suggests installing sainsburys/guzzle-oauth2-plugin (3.0 required for the OAuth2 authentication plugin) consolidation/robo suggests installing henrikbjorn/lurker (For monitoring filesystem changes in taskWatch) consolidation/robo suggests installing patchwork/jsqueeze (For minifying JS files in taskMinify) consolidation/robo suggests installing natxet/CssMin (For minifying CSS files in taskMinify) psy/psysh suggests installing ext-pdo-sqlite (The doc command requires SQLite to work.) psy/psysh suggests installing hoa/console (A pure PHP readline implementation. You'll want this if your PHP install doesn't already support readline or libedit.) drupal/config_filter suggests installing drupal/config_split (Split site configuration for different environments.) ``` And the following deprecations: ``` Package zendframework/zend-diactoros is abandoned, you should avoid using it. Use laminas/laminas-diactoros instead. Package zendframework/zend-stdlib is abandoned, you should avoid using it. Use laminas/laminas-stdlib instead. Package zendframework/zend-escaper is abandoned, you should avoid using it. Use laminas/laminas-escaper instead. Package zendframework/zend-feed is abandoned, you should avoid using it. Use laminas/laminas-feed instead. Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead. ``` The phar-stream-wrapper v2 is required, but v3 is recommended at https://github.com/TYPO3/phar-stream-wrapper for PHP 7.x: ``` ddev . composer prohibits drupal/core:8.8 drupal/core 8.8.0 requires typo3/phar-stream-wrapper (^3.1.3) agaric-sites/geo dev-master does not require typo3/phar-stream-wrapper (but v2.1.4 is installed) ``` Attempting to update: ``` ddev . composer require typo3/phar-stream-wrapper ^3.0 ./composer.json has been updated Gathering patches for root package. Removing package drupal/search_api so that it can be re-installed and re-patched. - Removing drupal/search_api (1.15.0) Deleting web/modules/contrib/search_api - deleted Loading composer repositories with package information Updating dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages. Problem 1 - Installation request for typo3/phar-stream-wrapper ^3.0 -> satisfiable by typo3/phar-stream-wrapper[3.x-dev, v3.0.0, v3.0.1, v3.1.0, v3.1.1, v3.1.2, v3.1.3, v3.1.4]. - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev]. - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev]. - drupal/core 8.7.12 requires typo3/phar-stream-wrapper ^2.1.1 -> satisfiable by typo3/phar-stream-wrapper[v2.x-dev]. - Conclusion: don't install typo3/phar-stream-wrapper v2.x-dev - Installation request for drupal/core (locked at 8.7.12) -> satisfiable by drupal/core[8.7.12]. Installation failed, reverting ./composer.json to its original content. ``` typo3+drupal 8.8: ``` ddev . composer require typo3/phar-stream-wrapper ^3.0 drupal/core ^8.8 No composer.json in current directory, do you want to use the one at /var/www/html? [Y,n]? GitHub API limit (60 calls/hr) is exhausted, could not fetch https://api.github.com/repos/drutopia/drutopia/tags?per_page=100. Create a GitHub OAuth token to go over the API rate limit. You can also wait until $ 020-03-19 06:09:15 for the rate limit to reset. Head to https://github.com/settings/tokens/new?scopes=repo&description=Composer+on+geo-web+2020-03-19+0542 to retrieve a token. It will be stored in "/home/wolcen/.composer/auth.json" for future use by Composer. Token (hidden): Token stored successfully. ./composer.json has been updated Gathering patches for root package. Loading composer repositories with package information Updating dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages. Problem 1 - Conclusion: remove drupal/claro 1.0.0-beta1 - Conclusion: don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.x-dev|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.9.x-dev|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.0|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.0-alpha1|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.0-beta1|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.0-rc1|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.1|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.2|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.3|don't install drupal/claro 1.0.0-beta1 - don't install drupal/core 8.8.4|don't install drupal/claro 1.0.0-beta1 - Installation request for drupal/claro (locked at 1.0.0-beta1, required as ^1.0@alpha) -> satisfiable by drupal/claro[1.0.0-beta1]. - Installation request for drupal/core ^8.8 -> satisfiable by drupal/core[8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.8.x-dev, 8.9.x-dev]. Installation failed, reverting ./composer.json to its original content. Failed to execute command composer require typo3/phar-stream-wrapper ^3.0 drupal/core ^8.8: exit status 2 ``` remove drupal/claro (expecting it to be included by drupal 8.8): ``` ddev . composer remove drupal/claro No composer.json in current directory, do you want to use the one at /var/www/html? [Y,n]? Gathering patches for root package. Loading composer repositories with package information Updating dependencies (including require-dev) Package operations: 1 install, 2 updates, 2 removals - Removing brumann/polyfill-unserialize (v1.0.4) - Removing drupal/core (8.7.12) Deleting web/core - deleted Gathering patches for root package. Gathering patches for dependencies. This might take a minute. - Updating typo3/phar-stream-wrapper (v2.1.4 => v3.1.4): Downloading (100%) - Removing drupal/claro (1.0.0-beta1) Deleting web/themes/contrib/claro - deleted - Installing drupal/core (8.8.4): Downloading (100%) - Applying patches for drupal/core https://www.drupal.org/files/issues/2018-11-27/2982052-22.patch (Allow an install hook in profiles installing from configuration) Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2018-11-27/2982052-22.patch - Installing drupal/search_api (1.15.0): Loading from cache - Applying patches for drupal/search_api https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch (Notice: Undefined index: total When we enable the module in the installation step) Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2931562-13--undefined_total_in_task_manager_batch_finish.patch ``` Here, Drupal 8.8 will now installs! However, need to research patches, replace deprecated dependencies. I believe drupal/claro is included in core (exists in `web/core/themes/claro/`), so that's set, right? Patch issues: - https://www.drupal.org/project/drupal/issues/2982052 (unclear to me what patch to use here) - https://www.drupal.org/project/search_api/issues/2931562 - CLOSED/we can remove this patch.

wolcen commented

2020-03-19 06:42:15 +00:00

(Migrated from gitlab.com)

changed title from {-Apply SA-CORE-2020-001-} to {+Upgrade to Drupal 8.8+}

changed title from **{-Apply SA-CORE-2020-001-}** to **{+Upgrade to Drupal 8.8+}**

wolcen commented

2020-03-19 06:42:15 +00:00

(Migrated from gitlab.com)

changed the description

mlncn commented

2020-03-20 17:04:56 +00:00

(Migrated from gitlab.com)