Problem/Motivation
The dependency system in drupal is lacking certain features that we need going forward to support several desired use cases.
Current dependency management is handled in two ways:
- There is a 'core' key in the info.yml files that expresses whether or not an extension should be able to be used on an existing drupal core installation.
- There are 'dependency' keys in info.yml files that expresses whether or not an extension has all of its required dependencies in order to be installed.
We would like to be able to support the following use cases:
- A drupal 8 extension, that is not using any deprecated code, should be able to be used with both drupal 8 and 9. (or 10/11 etc)
- An extension should be able to express specifically which version of core it requires. i.e. A module taking advantage of an api's introduced in drupal 8.7.0, and bugfixed in 8.7.2, should be able to say it requires *at least* drupal 8.7.2.
- An extension maintainers should be able to use semantic versioning for their modules, and should be able to express dependencies on other modules using semver constraint syntaxes.
- Drupal should prevent users from installing modules that do not have all of their dependencies available, including 3rd party composer libraries.
Proposed resolution
There are several issues in the queue attempting to tackle these problems somewhat independently, but they are all interlinked, and an overall strategy has emerged.
Option 1.
Deprecate dependency management inside of .info.yml files, and move dependency related functionality to composer.json. The core key, dependencies, and test-dependencies would all move to composer.json. All other keys would stay in the .info.yml files. Deprecate in 8.8.x and remove before 9.0.0.
Much work and discussion has happened here:
Option 2.
Enhance what our .info.yml files are capable of so that they can support multiple core versions, as well as allow the dependency specifications to use semver so that contrib maintainers can start using semver.
Many issues. Much work:
Option 3.
Enhance .info.yml files to allow for multiple versions of core, and add *optional* support for composer.json
Allowing for multiple versions of core:
And take most of the work from the following issue, and adapt it to work in parallel with the existing system.
In various discussions with release managers and other core contributors, the was a general sense that the deprecating dependency management in .info.yml files in favor of composer.json seemed unlikely to happen before drupal 9, and is a fundamentally structural change that affects all existing d8 modules. Option 1 seemed unlikely and/or risky.
The second option has several limitations, and essentially duplicates a lot of the functionality that we get with composer by default, and still cannot solve some other longstanding issues like "should a user be able to enable a module if its 3rd party dependencies are not there"
The third option emerged as a potential best possible scenario, given the timing and goals.
We would enhance our core key in .info.yml files to allow maintainers to have their modules work with both drupal 8 and 9, with very little effort on their part. At the same time, we would add in *optional* support for using a composer.json as the source of dependency metadata.
This would allow users to continue to do what they were doing before, however, if they needed any of the more advanced features of dependency management (semver requirements, third party libs, conflicts, ~/^ operators etc) then they would be able to use the more feature rich option of having a composer.json.
Remaining tasks
Confirm with release mangers and other stakeholders preferences for this path.