USAGOV-2010-drupal-10.3-upgrade: upgrade to 10.3

[jacobaaronyeager]

Jira Task

https://cm-jira.usa.gov/browse/USAGOV-2010

Description

Upgrades drupal core and related modules to Drupal 10.3

Type of Changes

• New Feature
• Bugfix
• Frontend (Twig, Sass, JS)
  • Add screenshot showing what it should look like
• Drupal Config (requires "drush cim")
• New Modules (requires rebuild)
• Documentation
• Infrastructure
  • CMS
  • WAF
  • WWW
  • Egress
  • Tools
  • Cron
• Other

Testing Instructions

Change Requirements

• Requires New Documentation (Link: {})
• Requires New Config
• Requires New Content

Validation Steps

• Test instruction 1
• Test instruction 2
• Test instruction 3

Security Review

• Adds/updates software (including a library or Drupal module)
• Communication with external service
• Changes permissions or workflow
• Requires SSPP updates

Reviewer Reminders

• Reviewed code changes
• Reviewed functionality
• Security review complete or not required

Post PR Approval Instructions

Follow these steps as soon as you merge the new changes.

1. Go to the USAGov Circle CI project.
2. Find the commit of this pull request.
3. Build and deploy the changes.
4. Update the Jira ticket by changing the ticket status to Review in Test and add a comment. State whether the change is already visible on cms-dev.usa.gov and beta-dev.usa.gov, or if the deployment is still in process.

[akf]

I tried this out and I'm running into some things:

• First, I merged the latest from dev in, and since someone else had added a module on dev, I'm getting a warning that my composer.lock file is out of date. It's probably just because the hash doesn't match. bin/composer update will fix that and, based on what happened for me, bring along a few point version updates.
• Three of the patches we specify don't apply! You'll need to find out why. I have high hopes that at least two of them don't apply because they've been merged into core. These are the patches that failed:
  • https://www.drupal.org/files/issues/2024-06-06/2118743-251.patch (Show views theme suggestions in twig debug)
  • https://www.drupal.org/files/issues/2023-10-26/add-taxonomy-revision-ui-2936995-58.patch (Add a taxonomy revision UI)
  • ./patches/drupal/taxonomy_revision_log.patch (Enable taxonomy revision log message)
• Once installed, Drupal fails with this error on any request, drush command, etc:
  "NOTICE: PHP message: PHP Fatal error: Cannot redeclare Drupal\taxonomy\Entity\Vocabulary::$new_revision in /var/www/web/core/modules/taxonomy/src/Entity/Vocabulary.php on line 121"

That last one is probably related to the taxonomy patch. I don't know whether it could have applied partially, or if we have something else intervening. Mike D added the revision UI as a patch so we wouldn't have to wait until we upgraded to 10.3 to have it.

I don't know why I get the fatal error and you didn't? My process was:

1. check out this branch
2. docker compose down
3. docker system prune --all
4. rm -r vendor
5. bin/init
6. docker compose up
7. Observe fatal errors, start looking more carefully at errors.

[akf]

This is working much better. I still see these things to fix:

• The "views theme suggestions" patch doesn't apply. Needs a little investigation.
• After I ran drush updatedb, drush cim showed a lot of config changes to apply. It continued to show them (or most of them) after multiple runs of drush cim. It looks like a lot of them are due to a change in conventions where we now use 0, 1, and the empty string instead of false, true, and null. We should verify what the changes are and, I think, include updated config/sync yml with this update.
• I see a couple of deprecated modules. We can go forward and address them after.

I'm going to make separate tickets for these so we can split the work up if that makes sense.

[akf]

This patch doesn't apply either. I looked up the corresponding issue and the last couple of comments imply that there isn't a Drupal 10.3-compatible version (see last comment). We can do without it, but I would like to look into this a little more.

Ref: https://www.drupal.org/project/drupal/issues/2118743

[akf]

I've started reviewing (by running it locally and doing some editing, running tome, etc.) and it's looking good so far. You'll note I ran the code scans; the two Medium vulnerabilities that were flagged are not new and we're already tracking them. (I've already dismissed the dependabot alert for one because it only applies to Windows systems.)

[akf]

I have just two small change requests -- see comments.

[akf]

My dev site keeps wanting to revert this -- please check and re-export if yours does too.