Release stability?

[woodseowl]

https://github.com/CU-CommunityApps/CD_cwd_saml_mapping/blob/52092cdfa4acbcc2a6470b333a275369ed403e99/composer.json#L15

Seems like for v1.0.0 this should be "stable"? Unless drupal/saml_sp is not stable?

And as I think about this question of "what version of drupal/saml_sp are we using", this would be a reason I'd like to see that module marked as a composer dependency -- it assures we know what version we are working with and can pin it if we need to. The module info.yml file doesn't specify that requirement.

[judaw]

saml_sp is at full release. I see in contrib. modules some adding dependencies in composer.json and some not. We are using the latest version of saml_sp. Do we really need to pin this in dependency?

[woodseowl]

It's not a blocker here, that's definitely true. I can see that it would only become critical if we need to enforce requiring a newer version of drupal/saml_sp. So, I'm happy to step away from it until that time.

[alisonjo315]

Chiming in even though it's closed!

I see these as two separate questions:

1. "minimum-stability" (set it or not, and what to set it at)
2. including saml_sp as a package requirement (not just an enabled module requirement, so to speak)

Ideally, we'd follow best practices, but, in my 1.5 minutes of searching, I didn't find a guideline about these two questions. I posted on Drupal Slack, to see if anyone knows if there are best practices.

Meanwhile, I spot-checked a bunch of "most used" modules: admin_toolbar, ctools, diff, inline_entity_form, paragraphs, pathauto, token.

• Thing 1: Most of the modules I checked skip this setting; a few do have the setting, and they all use "dev". Idk the purpose of this setting in the context of a module composer file, except when there's a specific need?
  • In my spot-checking, ctools and inline_entity_form are the only modules with this setting.
• Thing 2: Paragraphs and Pathauto are the only modules I checked that have dependencies.
  • Pathauto requires ctools and token, and it uses "*" as the version constraint for both.
  • Paragraphs requires entity_reference_revisions, version constraint "~1.3".
• (If it would be helpful, I can provide more package details.)

---

My take, unless I get info from the Drupal community:

• Let's drop the minimum-stability setting.
• Let's add drupal/saml_sp as a package requirement, with "*" as the version constraint.

diff --git a/composer.json b/composer.json
index 5a14db3..dda6454 100644
--- a/composer.json
+++ b/composer.json
@@ -12,6 +12,7 @@
         }
     ],
     "support": {},
-    "minimum-stability": "dev",
-    "require": {}
+    "require": {
+       "drupal/saml_sp": "*"
+    }
 }

[alisonjo315]

I added a PR, just to make it easy in case y'all agree 😉