Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update composer dependencies before 3.5 release #10973

Open
blesildaramirez opened this issue Feb 25, 2025 · 5 comments
Open

Update composer dependencies before 3.5 release #10973

blesildaramirez opened this issue Feb 25, 2025 · 5 comments
Assignees
Labels
Housekeeping:2:Urgent Any dependency management or refactor that must be done soon to fix or avoid a significant problem.
Milestone

Comments

@blesildaramirez
Copy link
Contributor

blesildaramirez commented Feb 25, 2025

Issue Description

Like #10969, let's do an update to our composer dependencies before releasing v3.5.
Relates to #9239

PRs
pkp-lib --> #10975
ojs --> pkp/ojs#4686 [TEST ONLY]
ops --> pkp/ops#889 [TEST ONLY]
omp --> pkp/omp#1859 [TEST ONLY]

@blesildaramirez blesildaramirez added the Housekeeping:2:Urgent Any dependency management or refactor that must be done soon to fix or avoid a significant problem. label Feb 25, 2025
@blesildaramirez blesildaramirez added this to the 3.5 Internal milestone Feb 25, 2025
@touhidurabir touhidurabir self-assigned this Feb 25, 2025
touhidurabir added a commit to touhidurabir/pkp-lib that referenced this issue Feb 25, 2025
touhidurabir added a commit to touhidurabir/ojs that referenced this issue Feb 25, 2025
touhidurabir added a commit to touhidurabir/pkp-lib that referenced this issue Feb 25, 2025
touhidurabir added a commit to touhidurabir/ojs that referenced this issue Feb 25, 2025
@touhidurabir
Copy link
Member

touhidurabir commented Feb 25, 2025

Unable to update Details :

  1. moxiecode/plupload from 2.* to 3.* as 3.* has some breaking changes like Difference between 2.x and 3.x? Missing "multipart_params" with upload. moxiecode/plupload#1574
  2. smarty/smarty from 4.* to 5.* as there is a lot of breaking changes, more details at https://smarty-php.github.io/smarty/5.x/upgrading/

@touhidurabir
Copy link
Member

@asmecher do you think we should take this chance to upgrade to laravel 12 which released just few days ago ? There seems to be no breaking changes in Laravel 12 , see more at https://laravel.com/docs/12.x/upgrade . However this may be late for our 3.5 dev cycle but perhaps still possible .

@asmecher
Copy link
Member

@touhidurabir, if it's indeed a low risk/low impact update then I think we might just as well wait until a later build to bump to Laravel 12.

@asmecher
Copy link
Member

For Smarty, we're waiting for a fix on #10243, but it's just cosmetic (to resolve warnings), and it doesn't appear to be resolved in 5.x either. I don't see a major incentive to upgrade to 5.x so late in the release cycle, and I don't see a formal end-of-life announcement for Smarty 4.x. I'm a little nervous of Smarty's stewardship of late, so am comfortable staying conservative at the moment.

@asmecher
Copy link
Member

Last of all, on plupload, I don't recommend a breaking change so late in the game. This is all client-side, so doesn't present the same potential for a server-side attack surface; we will have to revisit our file upload toolkit eventually (e.g. for #4947) and it makes sense to look at this dependency at the same time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Housekeeping:2:Urgent Any dependency management or refactor that must be done soon to fix or avoid a significant problem.
Projects
None yet
Development

No branches or pull requests

3 participants