Upgrade dependencies by blued-gear · Pull Request #2162 · MbinOrg/mbin

blued-gear · 2026-06-28T21:40:24Z

Summary

This PR upgrades all dependencies, including PHP, Symfony and JS. Broken code was fixed, many (but not all) new deprecations cleaned and the functionality of the site restored with best effort. A summary of major version jumps is attached at the end of this text.

I'm asking you to

verify the state of the site. There are many things I and the tests can not check; like 2FA and OAuth authenticator integration (Google, Github, ...).
We need a graceful rollout of this branch from dev to prod-like environments to ensure all broken thing (which likely still exist) get caught.

Other fixes

While I was at it, I fixed smaller things which annoyed me ;)

in the "create entry" page the Magazine search is now case-insensitive and clears old search-results when typing a name

Todo

upgrade PHP in the Docker containers
revert content of to be reverted commits
update docs

Upgrades

php:
php 8.3 -> 8.5
- notable new features:
- Asymmetric Visibility
- Property hooks
- New array_*() functions + array_first() and array_last() functions
- Fatal Errors (such as an exceeded maximum execution time) now include a backtrace
- Pipe Operator
- Uri class
- breaking changes:
- Using null as an array offset or when calling array_key_exists() is now deprecated
doctrine-bundle 2.18 -> 3.2
- https://github.com/greg0ire/DoctrineBundle/blob/4.0.x/UPGRADE-3.0.md
doctrine-migrations-bundle 3.7 -> 4.0
- https://github.com/derrabus/DoctrineMigrationsBundle/blob/4.0.x/UPGRADE.md
- https://github.com/doctrine/migrations/blob/3.0.x/UPGRADE.md
- need to run the doctrine:migrations:sync-metadata-storage command
oauth2-google 4 -> 5
- https://github.com/thephpleague/oauth2-google/blob/main/CHANGELOG.md
reflection-docblock 5.4 -> 6.0
- do we even use this?
2fa-backup-code, 2fa-bundle, 2fa-totp 7.5 -> 8.6
- https://github.com/scheb/2fa/blob/8.x/UPGRADE.md#7x-to-8x
- Priority of the two-factor authenticator has changed from 0 to -100
oauth2-keycloak 5.1 -> 6.1
- https://github.com/stevenmaguire/oauth2-keycloak/releases/tag/6.0.0
- nothing major changed
ux-autocomplete 2.18 -> 3.2
- https://github.com/symfony/ux-autocomplete/blob/3.x/CHANGELOG.md
- nothing major changed for us
ux-chartjs 2.18 -> 3.2
- https://github.com/symfony/ux-chartjs/blob/3.x/CHANGELOG.md
- nothing major changed for us
ux-twig-component 2.18 -> 3.2
- https://github.com/symfony/ux-twig-component/blob/3.x/CHANGELOG.md
- nothing major changed for us
webmozart/assert 1.11 -> 2.4
- https://github.com/webmozarts/assert/blob/master/CHANGELOG.md
- nothing major changed for us
phpunit 12.5 -> 13.2
- https://github.com/sebastianbergmann/phpunit/releases/tag/13.0.0
- nothing major changed for us

js:
babel/core 7.29 -> 8.0
- https://babeljs.io/docs/v8-migration/
babel/preset-env 7.29 -> 8.0
eslint/js 9.39 -> 10.0, eslint 9.39 -> 10.5
- https://github.com/eslint/eslint/releases/tag/v10.0.0
fontawesome-free 6.7 -> 7.3
- https://fontawesome.com/changelog
- Icon canvases now render at a consistent fixed width. To use the default rendering from v6, add our new fa-width-auto class.
stylistic/eslint-plugin 2.13 -> 5.10
- https://github.com/eslint-stylistic/eslint-stylistic/releases/tag/v5.0.0
- nothing major changed for us
symfony/stimulus-bridge 3.2 -> 4.0
- https://github.com/symfony/stimulus-bridge/releases/tag/v4.0.0
- nothing major changed for us
symfony/webpack-encore 5.3 -> 7.1
- https://github.com/symfony/webpack-encore/blob/main/UPGRADE.md
- needed changes were applied
chart.js 3.8 -> 4.5
- https://www.chartjs.org/docs/latest/migration/v4-migration.html
- not directly used by us (Symfony handles it)
globals 15.15 -> 17.7
hotkeys-js 3.13 -> 4.0
- https://github.com/jaywcjlove/hotkeys-js/releases/tag/v4.0.0
- no notable changes
- do we even use this?
sass-loader 16.0 -> 17.0
- https://github.com/webpack/sass-loader/releases/tag/v17.0.0
- no notable changes
simple-icons-font 14.15 -> 16.24
- https://github.com/simple-icons/simple-icons-font/releases/tag/15.0.0
- https://github.com/simple-icons/simple-icons/releases/tag/16.0.0
- no notable changes
webpack-cli 5.1 -> 7.0
- https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md
- only used by Symfony

GL HF

and possible break everything

garrettw · 2026-06-29T01:53:20Z

I probably wouldn't have done a PHP upgrade at the same time as all dependencies. This is a pretty big surface area for one PR.

I would probably split it up as (in this order):

Low-impact dep upgrades (security patches, non-BC-breaking stuff)
High-impact dep upgrades (major versions, BC breaks ... and depending on how many packages it is and how many changes are needed to support the upgrade, maybe not all of them in the same PR)
PHP upgrade, plus only the packages that must be upgraded as part of the PHP change
Then go back and repeat...
Low-impact
High-impact

It's just that this is a lot to review, and when you change so many moving pieces at once ... I just feel like there's more chances for something to go wrong. I tend to feel more confident about smaller, more incremental PRs.

Oh and I typically would separate PHP dep updates from JS ones, but that could be just me.

blued-gear · 2026-06-29T07:15:39Z

I get what you are saying and am not totally against it, but still would prefer to get through this in one go. We did not maintain our dependencies correctly in the past which created this tech debt and splitting it up into the process described by you would create a lot of PRs with duplicated work and in sum as much for you to review as when it is done at once. I'm quite sure it would take much longer to finish the process as everyone would have to find time to go through new PRs again and again + running it on their instances (with one PR we can easily roll back to a known good state as no DB migrations are involved). Also, some of the versions (like Symfony and some JS dependencies) must be updated together.

I know this is a lot, but after this we will keep things updated in a timely manner and with narrow-scoped PRs.

# Conflicts: # composer.lock # package-lock.json

blued-gear · 2026-07-23T16:29:03Z

Test is failing because of this: thephpleague/oauth2-server-bundle#301

# Conflicts: # package-lock.json

# Conflicts: # src/Form/Type/MagazineAutocompleteType.php

BentiGorlich

I do not understand what changed with the RSS feed, can you explain that a bit?

BentiGorlich · 2026-08-18T16:30:25Z

+            uk: uk.default,
+            zh_TW: zh_TW.default,
+        };
+        timeago.register(lang, languages[lang]);


What happens if the language is not available? Is there a fallback?

I added a check. The library has a fallback to en_US if no lang arg is passed.

BentiGorlich · 2026-08-18T16:31:13Z

 @use '../mixins/mbin';
-@use '@fortawesome/fontawesome-free/scss/fontawesome' as fa;
+@use '@fortawesome/fontawesome-free/scss/fa' as fa;
+@use '@fortawesome/fontawesome-free/scss/solid' as faSolid;


This is imported twice now

I think I kept the former alias for compatibility.
I will remove it in a separate commit, so that the removal can be reverted when problems come up in a larger test.

BentiGorlich · 2026-08-18T16:31:36Z

  appearance: none;
  font-size: 0.9rem;
-  display: grid;
+  display: grid !important;


this doesn't look good, why is the !important needed?

Same reason as on width: the mixin @include faSolid.icon(fa.$var-check); sets rules for width and display with values we don't want.
I just checked and it seems to work now without it; I will remove it in a separate commit, so that the removal can be reverted when problems come up in a larger test.

BentiGorlich · 2026-08-18T16:33:57Z

-        handler_id: App\MigratePdoToRedisSessionHandler
+        #handler_id: App\MigratePdoToRedisSessionHandler
        # new
-        #handler_id: Symfony\Component\HttpFoundation\Session\Storage\Handler\RedisSessionHandler
+        handler_id: Symfony\Component\HttpFoundation\Session\Storage\Handler\RedisSessionHandler


This should not be committed, yet. I believe I explained before why

BentiGorlich · 2026-08-18T16:34:19Z

What is this for?

It was generated by a Symfony recipe. I don't know what it is for either.

BentiGorlich · 2026-08-18T16:56:33Z

+    "php-http/discovery": {
+        "version": "1.20",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "1.18",
+            "ref": "f45b5dd173a27873ab19f5e3180b2f661c21de02"
+        },
+        "files": [
+            "config/packages/http_discovery.yaml"
+        ]
+    },


I don't understand what this is for

This was added automatically by a Symfony recipe.

BentiGorlich · 2026-08-18T16:57:45Z

+    .configureJsMinimizerPlugin((options, MinimizerPlugin) => {
+        options.minify = MinimizerPlugin.esbuildMinify
+    })
+    .configureCssMinimizerPlugin((options, MinimizerPlugin) => {
+        options.minify = MinimizerPlugin.lightningCssMinify;
+    })


This will change our js build a lot, right?

Yes, but I adjusted our sources were necessary and all builds fine (for me at least).

BentiGorlich · 2026-08-18T16:58:22Z

Did this come from a package?

If I remember right, I wrote this with the help of https://symfony.com/bundles/ux-autocomplete/current/index.html and https://tom-select.js.org/docs/#callbacks .

BentiGorlich · 2026-08-18T17:00:24Z

I don't undserstand these changes, but I also don't know what this is used for...

The popover is used for example when details of a user are shown as an overlay when hovered. It was quite old code not compatible with mjs, so I rewrote the original source in a more modern way.

BentiGorlich · 2026-08-18T17:01:04Z

why these changes?

Changed in commit 0b3a196 'fix a deprecation', so I think (I can't remember anymore) it was prompted in a deprecation warning that it should be removed.

blued-gear added 30 commits June 14, 2026 16:39

bump version to 1.10.0

cedc38c

update vulnerable dependency

afb9c36

Merge branch 'main' into bump_version

63e3e20

update to PHP 8.5 (composer broken)

06b0558

update dependencies for new PHP

fe1aa7d

fix small mistakes in code

6611f77

update Symfony part 1

11757de

update Symfony part 2

551cc02

to be reverted

22c1fa7

update Symfony part 3

1d71452

update Symfony part 4

0117a40

update Symfony part 5

ec2078b

update Symfony part 6

26aeb24

to be reverted

f9d88e8

update Symfony part 7

601c305

update Symfony part 8

e1eed09

update Symfony part 9

bbead0d

update Symfony part 10

b85dba5

update Symfony part 11

99d0b16

update Symfony part 12

f683706

"fix" deprecation

466c652

Merge branch 'main' into bump_version

cccb306

rip out abandoned rss-atom-bundle

72774b8

update everything

8a0e373

and possible break everything

note about deprecation

aa78b23

reimplement RSS

fa76b3e

cleanup composer.json

e285627

apply changes by major dependencies updates

02af2b4

apply changes by major dependencies updates

2ae95c1

update recipe

e5d838e

blued-gear and others added 10 commits June 30, 2026 20:06

Merge branch 'main' into upgrade_dependencies

300c9a5

Merge branch 'main' into upgrade_dependencies

ec98ebc

# Conflicts: # composer.lock # package-lock.json

revert 'to be reverted' commits

a21eb1d

Merge branch 'main' into upgrade_dependencies

82506fb

# Conflicts: # composer.lock # package-lock.json

fix frankenphp config

4682468

update php dependencies

daa063f

update js dependencies

515fba7

update recipe symfony/webpack-encore-bundle

2c73496

update recipe symfony/twig-bundle

e771197

update recipe symfony/stimulus-bundle

956288f

blued-gear added 11 commits July 28, 2026 13:49

Merge branch 'main' into upgrade_dependencies

151c12a

# Conflicts: # package-lock.json

update dependencies

be1a19e

Merge branch 'main' into upgrade_dependencies

2e2c39d

# Conflicts: # src/Form/Type/MagazineAutocompleteType.php

update dependencies

7066a9c

fix npm allowScripts

869def4

update dependencies

655d587

fix wrong migration for InstanceBlock::instanceDomain

e7a0909

add doctrine-psql-enum plugin to fix migration-generation

0bb2e20

DB migration

dd0d38a

Merge branch 'main' into upgrade_dependencies

be7282a

remove some parts from the migration

ca15fc9

BentiGorlich requested changes Aug 18, 2026

View reviewed changes

blued-gear added 5 commits August 27, 2026 18:32

Merge branch 'main' into upgrade_dependencies

77f1287

update dependencies

fe510e9

clean up _forms.scss. might need to be reverted.

24d8610

apply review comments

4779f13

fix nullpointerexception

44a6856

Uh oh!

Conversation

blued-gear commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

I'm asking you to

Other fixes

Todo

Upgrades

Uh oh!

garrettw commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blued-gear commented Jun 29, 2026

Uh oh!

blued-gear commented Jul 23, 2026

Uh oh!

BentiGorlich left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

blued-gear commented Jun 28, 2026 •

edited

Loading

garrettw commented Jun 29, 2026 •

edited

Loading