changes.md

Major changes

The following major version bumps indicate breaking changes:

• 5.x:

  • Drupal core 9.5.

  • Replaced Ambient-Impact/drupal-modules Git submodule with subtree split individual modules.

  • First pass at upgrading our code to be compatible with Drupal 10.

• 6.x:

  • Drupal core 10.0.

  • The following modules have been temporarily switched over to forks for Drupal 10 support:

    • Development Environment

    • Image Field Caption

    • Markdown Now has a Drupal 10 release.

    • Paranoia Now has a Drupal 10 release.

  • The Rules module has been switched from 3.0.0-alpha7 to 3.x-dev@dev for Drupal 10 support; the patch for Support upcasting entity IDs to full entity contexts [#2800749] has been removed because it's in the dev release.

  • Uninstalled the deprecated Swift Mailer module and the Mail System module that it required. This was only ever used for Commerce emails, which we haven't used for some time.

• 7.x:

  • Drupal core 10.1.

  • Uninstalled and removed the AdvAgg module as Drupal core 10.1 provides much of what we needed it for.

• 8.x:

  • Increased major versions of the following Omnipedia modules:

    • omnipedia_access 4.x to 5.x.

    • omnipedia_block 5.x to 6.x.

    • omnipedia_user 5.x to 6.x.

  • Uninstalled and removed omnipedia_commerce and all Commerce modules:

    • Uninstalled the omnipedia_commerce module.

    • Uninstalled the Permissions by Term module; this was used for access control for the season pass; due to multiple issues with the quality of the module's code and unnecessary complications it introduced, we've decided to completely remove it as well; a sampling of the worst issues:

      • Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2022-055: a security issue that sat unfixed publicly in the issue queue for months until the security team got involved.

      • Regression updating to 3.1.22 for Drupal 9.x using loadTemplate from twig [#3354478]: a badly thought out and implemented hack that somehow made it into a stable release for potentially thousands of sites that resulted in a fatal error when trying to view the node edit form, rendering content uneditable; the linked comment in the issue goes into more detail.

      • Node Access Rebuilt unnecessarily if no change to user terms. [#3170389]

      • Permissions by Entity PHP notice for Commerce Product entities [#3231188]

      • Respect the Require all terms granted and Permission mode settings in Permission by entity module [#3072171]

    • Uninstalled all Commerce Core modules.

    • Uninstalled the Commerce Cart Redirection module.

    • Uninstalled the Commerce PayPal module.

    • Uninstalled the Commerce Product Limits module.

    • Uninstalled the Commerce Stripe module.

    • Uninstalled their dependencies:

      • The Address module.

      • The Entity API module.

      • The Entity Reference Revisions module.

      • The Inline Entity Form module.

      • The Profile module.

      • The State Machine module.

    • Removed all their related configuration, fields, entity types, permissions, and so on.

• 9.x:

  • This is the culimation of nearly a year of work that was done in parallel with the main branches to port Omnipedia to DigitalOcean's App Platform. It required significant engineering to rework the entire front-end and back-end build processes to fully automate them, because the file system on App Platform is ephemeral with each deployment occurring on a completely fresh file system. To get a sense of the changes involved, see the comparison between the 8.x and 8.x_digitalocean branches. The work occurred in these branches:

    • 4.x_digitalocean

    • 5.x_digitalocean

    • 6.x_digitalocean

    • 7.x_digitalocean

    • 8.x_digitalocean

  • All uploaded files and generated image styles are hosted on DigitalOcean Spaces, their S3-compatible object storage; this is necessary due to the emphemeral nature of the App Platform file system, meaning they would get wiped on the next deploy if stored locally. On the Drupal side, this is implemented using the S3 File System module.

  • The entire Composer and Yarn install process is now automated and installs everything on deploy; all front-end CSS and other assets are built via Yarn and Webpack during this process.

  • Email is now sent out using a third-party email service as DigitalOcean blocks sending of email directly from their Droplets or App Platform to prevent use of their services for spam.

  • Session cookie security has been hardened significantly, along with many other security improvements.

  • The web root directory has been renamed from drupal to web to be more in line with standard Drupal practices.