.gitattributes

@@ -19,32 +19,36 @@
 *.config  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.css     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.dist    text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
-*.engine  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.engine  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.html    text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=html
-*.inc     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
-*.install text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.inc     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
+*.install text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.js      text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.json    text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.lock    text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.map     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.md      text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
-*.module  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
-*.php     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.module  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
+*.php     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.po      text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
-*.profile text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.profile text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.script  text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
-*.sh      text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.sh      text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.sql     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.svg     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
-*.theme   text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
+*.theme   text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
 *.twig    text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.txt     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.xml     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.yml     text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 
+# PHPStan's baseline uses tabs instead of spaces.
+core/.phpstan-baseline.php text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tabwidth=2 diff=php linguist-language=php
+
 # Define binary file attributes.
 # - Do not treat them as text.
 # - Include binary diff in patches instead of "binary files differ."
+*.avif    -text diff
 *.eot     -text diff
 *.exe     -text diff
 *.gif     -text diff

.gitlab-ci/pipeline-test-only.yml

+# cspell:ignore drupaltestbot drupaltestbotpw Dwebdriver logfile XVFB
+
+stages:
+  - 🗜️ Test
+
+variables:
+  FF_NETWORK_PER_BUILD: 1
+  SIMPLETEST_BASE_URL: http://localhost/subdirectory
+  DB_DRIVER: mysql
+  MYSQL_ROOT_PASSWORD: root
+  MYSQL_DATABASE: mysql
+  MYSQL_USER: drupaltestbot
+  MYSQL_PASSWORD: drupaltestbotpw
+  POSTGRES_DB: drupaltestbot
+  POSTGRES_USER: drupaltestbot
+  POSTGRES_PASSWORD: drupaltestbotpw
+  MINK_DRIVER_ARGS_WEBDRIVER: '["chrome", {"browserName":"chrome", "goog:chromeOptions":{"w3c": true, "args":["--no-sandbox","--ignore-certificate-errors", "--allow-insecure-localhost", "--headless", "--dns-prefetch-disable"]}}, "http://selenium:4444"]'
+
+'🩹 Test-only changes':
+  stage: 🗜️ Test
+  interruptible: true
+  image:
+    name: $_CONFIG_DOCKERHUB_ROOT/php-$_TARGET_PHP-apache:production
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "parent_pipeline" && $PERFORMANCE_TEST != "1"
+  needs:
+    - pipeline: $PARENT_PIPELINE_ID
+      job: '🧹 PHP Coding standards (PHPCS)'
+  services:
+    - name: $_CONFIG_DOCKERHUB_ROOT/$_TARGET_DB:production
+      alias: database
+    - name: selenium/standalone-chrome:latest
+      alias: selenium
+      variables:
+        JAVA_OPTS: "-Dwebdriver.chrome.logfile=/builds/chromedriver.log"
+        SE_NODE_OVERRIDE_MAX_SESSIONS: "true"
+        SE_NODE_MAX_SESSIONS: "5"
+        SE_START_XVFB: "false"
+        SE_START_VNC: "false"
+  before_script:
+    - |
+      [[ $_TARGET_DB == sqlite* ]] && export SIMPLETEST_DB=sqlite://localhost/$CI_PROJECT_DIR/sites/default/files/db.sqlite?module=sqlite
+      [[ $_TARGET_DB == mysql* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == mariadb* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == pgsql* ]] && export SIMPLETEST_DB=pgsql://$POSTGRES_USER:$POSTGRES_PASSWORD@database/$POSTGRES_DB?module=pgsql
+    - $CI_PROJECT_DIR/.gitlab-ci/scripts/server-setup.sh
+  script:
+    - $CI_PROJECT_DIR/.gitlab-ci/scripts/test-only.sh
+  after_script:
+    - sed -i "s#$CI_PROJECT_DIR/##" ./sites/default/files/simpletest/phpunit-*.xml || true
+  artifacts:
+    when: always
+    expire_in: 6 mos
+    reports:
+      junit: ./sites/default/files/simpletest/phpunit-*.xml
+    paths:
+      - ./sites/default/files/simpletest/phpunit-*.xml
+      - ./sites/simpletest/browser_output

.gitlab-ci/pipeline.yml

+# cspell:ignore drupaltestbot drupaltestbotpw Dwebdriver logfile XVFB
+
+stages:
+  - 🗜️ Test
+
+#############
+# Templates #
+#############
+
+default:
+  interruptible: true
+  retry:
+    max: 2
+    when:
+      - unknown_failure
+      - api_failure
+      - stuck_or_timeout_failure
+      - runner_system_failure
+      - scheduler_failure
+  image:
+    name: $_CONFIG_DOCKERHUB_ROOT/php-$_TARGET_PHP-apache:production
+  before_script:
+    - |
+      [[ $_TARGET_DB == sqlite* ]] && export SIMPLETEST_DB=sqlite://localhost/$CI_PROJECT_DIR/sites/default/files/db.sqlite?module=sqlite
+      [[ $_TARGET_DB == mysql* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == mariadb* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == pgsql* ]] && export SIMPLETEST_DB=pgsql://$POSTGRES_USER:$POSTGRES_PASSWORD@database/$POSTGRES_DB?module=pgsql
+    - echo "SIMPLETEST_DB = $SIMPLETEST_DB"
+    - $CI_PROJECT_DIR/.gitlab-ci/scripts/server-setup.sh
+  after_script:
+    - sed -i "s#$CI_PROJECT_DIR/##" ./sites/default/files/simpletest/phpunit-*.xml || true
+  artifacts:
+    when: always
+    expire_in: 6 mos
+    reports:
+      junit: ./sites/default/files/simpletest/phpunit-*.xml
+    paths:
+      - ./sites/default/files/simpletest/phpunit-*.xml
+      - ./sites/simpletest/browser_output
+      - '*.log'
+
+.default-job-settings: &default-job-settings
+  stage: 🗜️ Test
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "parent_pipeline" && $PERFORMANCE_TEST != "1"
+
+.with-composer: &with-composer
+  needs:
+    - pipeline: $PARENT_PIPELINE_ID
+      job: '🧹 PHP Coding standards (PHPCS)'
+
+.with-composer-and-yarn: &with-composer-and-yarn
+  needs:
+    - pipeline: $PARENT_PIPELINE_ID
+      job: '🧹 PHP Coding standards (PHPCS)'
+    - pipeline: $PARENT_PIPELINE_ID
+      job: '📔 Spell-checking'
+
+variables:
+  FF_NETWORK_PER_BUILD: 1
+  SIMPLETEST_BASE_URL: http://localhost/subdirectory
+  DB_DRIVER: mysql
+  MYSQL_ROOT_PASSWORD: root
+  MYSQL_DATABASE: mysql
+  MYSQL_USER: drupaltestbot
+  MYSQL_PASSWORD: drupaltestbotpw
+  POSTGRES_DB: drupaltestbot
+  POSTGRES_USER: drupaltestbot
+  POSTGRES_PASSWORD: drupaltestbotpw
+  MINK_DRIVER_ARGS_WEBDRIVER: '["chrome", {"browserName":"chrome", "goog:chromeOptions":{"w3c": true, "args":["--no-sandbox","--ignore-certificate-errors", "--allow-insecure-localhost", "--headless", "--dns-prefetch-disable"]}}, "http://selenium:4444"]'
+  MINK_DRIVER_ARGS_WEBDRIVER_CHROMEDRIVER_NON_W3C: '["chrome", {"browserName":"chrome","goog:chromeOptions":{"args":["--disable-dev-shm-usage","--disable-gpu","--headless","--dns-prefetch-disable"]}}, "http://localhost:9515"]'
+  CI_PARALLEL_NODE_INDEX: $CI_NODE_INDEX
+  CI_PARALLEL_NODE_TOTAL: $CI_NODE_TOTAL
+
+.with-database: &with-database
+  name: $_CONFIG_DOCKERHUB_ROOT/$_TARGET_DB:production
+  alias: database
+
+.with-chrome: &with-chrome
+  name: $_CONFIG_DOCKERHUB_ROOT/chromedriver:production
+  alias: chrome
+  entrypoint:
+    - chromedriver
+    - "--no-sandbox"
+    - "--log-path=/builds/chromedriver.log"
+    - "--whitelisted-ips="
+    - "--allowed-origins=*"
+
+.with-selenium-chrome: &with-selenium-chrome
+  name: selenium/standalone-chrome:127.0
+  alias: selenium
+  variables:
+    JAVA_OPTS: "-Dwebdriver.chrome.logfile=/builds/chromedriver.log"
+    SE_NODE_OVERRIDE_MAX_SESSIONS: "true"
+    SE_NODE_MAX_SESSIONS: "16"
+    SE_SESSION_RETRY_INTERVAL: "1"
+    SE_SESSION_REQUEST_TIMEOUT: "60"
+    SE_START_XVFB: "true"
+    SE_START_VNC: "false"
+
+.run-tests: &run-tests
+  script:
+    # Need to pass this along directly.
+    - sudo -u www-data -E -H php ./core/scripts/run-tests.sh --color --keep-results --types "$TESTSUITE" --concurrency "$CONCURRENCY" --repeat "1" --sqlite "./sites/default/files/tests.sqlite" --dburl $SIMPLETEST_DB --url $SIMPLETEST_BASE_URL --verbose --non-html --all --ci-parallel-node-index $CI_PARALLEL_NODE_INDEX --ci-parallel-node-total $CI_PARALLEL_NODE_TOTAL
+
+.run-repeat-class-test: &run-repeat-class-test
+  script:
+    - echo "ℹ️ Running class ${REPEAT_TEST_CLASS}"
+    - |
+      if [[ $REPEAT_TEST_CLASS == "Drupal\Tests\Change\Me" ]]; then
+        echo '❗ You need to change the REPEAT_TEST_CLASS variable to an existing class before running the job.'
+        echo '   You just need to click on the job that you want to run (do not press the play button straight away) and then set the following:'
+        echo '   "Key" to "REPEAT_TEST_CLASS" and "Value" to "Drupal\Tests\ckeditor5\FunctionalJavascript\MediaLinkabilityTest"';
+        exit 1;
+      else
+        sudo -u www-data -E -H php ./core/scripts/run-tests.sh --color --keep-results --concurrency "$CONCURRENCY" --repeat "100" --sqlite "./sites/default/files/tests.sqlite" --dburl $SIMPLETEST_DB --url $SIMPLETEST_BASE_URL --verbose --non-html --class $REPEAT_TEST_CLASS
+      fi
+
+################
+# Jobs
+#
+# Jobs define what scripts are actually executed in each stage.
+#
+# The 'rules' keyword can also be used to define conditions for each job.
+#
+# Documentation: https://docs.gitlab.com/ee/ci/jobs/
+################
+
+'🩹 Test-only changes':
+  <<: [ *with-composer, *default-job-settings ]
+  when: manual
+  allow_failure: true
+  services:
+    - <<: *with-database
+    - <<: *with-selenium-chrome
+  script:
+    - $CI_PROJECT_DIR/.gitlab-ci/scripts/test-only.sh
+
+'🖱️️️ PHPUnit Functional Javascript':
+  <<: [ *with-composer, *run-tests, *default-job-settings ]
+  parallel: 3
+  variables:
+    TESTSUITE: PHPUnit-FunctionalJavascript
+    CONCURRENCY: 5
+    KUBERNETES_CPU_REQUEST: "16"
+  services:
+    - <<: *with-database
+    - <<: *with-selenium-chrome
+  after_script:
+    - echo $MINK_DRIVER_ARGS_WEBDRIVER
+    - sed -i "s#$CI_PROJECT_DIR/##" ./sites/default/files/simpletest/phpunit-*.xml || true
+    - cp /builds/chromedriver.log ./
+
+'👷️️️ PHPUnit Build':
+  <<: [ *with-composer, *run-tests, *default-job-settings ]
+  variables:
+    TESTSUITE: PHPUnit-Build
+    KUBERNETES_CPU_REQUEST: "8"
+    CONCURRENCY: "5"
+  services:
+    - <<: *with-database
+
+'🌐️️ PHPUnit Functional':
+  <<: [ *with-composer, *run-tests, *default-job-settings ]
+  parallel: 8
+  variables:
+    TESTSUITE: PHPUnit-Functional
+    CONCURRENCY: "5"
+    KUBERNETES_CPU_REQUEST: "16"
+  services:
+    - <<: *with-database
+
+'⚙️️ PHPUnit Kernel':
+  <<: [ *with-composer, *run-tests, *default-job-settings ]
+  parallel: 5
+  variables:
+    TESTSUITE: PHPUnit-Kernel
+    KUBERNETES_CPU_REQUEST: "8"
+    CONCURRENCY: 12
+  services:
+    - <<: *with-database
+
+'🦉️️️ Nightwatch':
+  <<: [ *with-composer-and-yarn, *default-job-settings ]
+  variables:
+    KUBERNETES_CPU_REQUEST: "16"
+  services:
+    - <<: *with-database
+    - <<: *with-selenium-chrome
+  script:
+    - export DRUPAL_TEST_DB_URL=$SIMPLETEST_DB
+    - cp ./core/.env.example ./core/.env
+    # dotenv-safe/config does not support environment variables
+    # @see https://github.com/rolodato/dotenv-safe/issues/126
+    # @todo move this to `variables` when the above is resolved
+    - echo "DRUPAL_TEST_BASE_URL='http://localhost/subdirectory'" >> ./core/.env
+    - echo "DRUPAL_TEST_CHROMEDRIVER_AUTOSTART=false" >> ./core/.env
+    - echo "DRUPAL_TEST_DB_URL='${DRUPAL_TEST_DB_URL}'" >> ./core/.env
+    - echo "DRUPAL_TEST_WEBDRIVER_HOSTNAME='selenium'" >> ./core/.env
+    - echo "DRUPAL_TEST_WEBDRIVER_CHROME_ARGS='--disable-dev-shm-usage --disable-gpu --headless --dns-prefetch-disable'" >> ./core/.env
+    - echo "DRUPAL_TEST_WEBDRIVER_W3C=true" >> ./core/.env
+    - echo "DRUPAL_TEST_WEBDRIVER_PORT='4444'" >> ./core/.env
+    - echo "DRUPAL_NIGHTWATCH_OUTPUT='"../nightwatch_output"'" >> ./core/.env
+    - echo "COLUMNS=1000" >> ./core/.env
+    - chown -R www-data:www-data ./sites /var/www
+    - cd core
+    - corepack enable
+    - sudo -u www-data -E -H yarn run test:nightwatch --workers=3
+  after_script:
+    - cp /builds/chromedriver.log ./
+  artifacts:
+    when: always
+    expire_in: 6 mos
+    reports:
+      junit: ./nightwatch_output/**/*.xml
+    paths:
+      - ./nightwatch_output
+      - '*.log'
+
+'🖱️️️ PHPUnit Functional Javascript (non W3C legacy)':
+  <<: [ *with-composer, *default-job-settings ]
+  parallel: 1
+  variables:
+    TESTSUITE: PHPUnit-FunctionalJavascript
+    CONCURRENCY: 6
+    KUBERNETES_CPU_REQUEST: "16"
+    MINK_DRIVER_ARGS_WEBDRIVER: $MINK_DRIVER_ARGS_WEBDRIVER_CHROMEDRIVER_NON_W3C
+  services:
+    - <<: *with-database
+    - <<: *with-chrome
+  script:
+    # Run a small subset of tests to prove non W3C testing still works.
+    - sudo -u www-data -E -H php ./core/scripts/run-tests.sh --color --keep-results --types "$TESTSUITE" --concurrency "$CONCURRENCY" --repeat "1" --sqlite "./sites/default/files/tests.sqlite" --dburl $SIMPLETEST_DB --url $SIMPLETEST_BASE_URL --verbose --non-html javascript
+
+  after_script:
+    - sed -i "s#$CI_PROJECT_DIR/##" ./sites/default/files/simpletest/phpunit-*.xml || true
+    - cp /builds/chromedriver.log ./
+
+'🔁 Repeat Class Test':
+  <<: [ *with-composer, *run-repeat-class-test, *default-job-settings ]
+  when: manual
+  allow_failure: true
+  variables:
+    REPEAT_TEST_CLASS: 'Drupal\Tests\Change\Me'
+  services:
+    - <<: *with-database
+
+'🚲 Performance tests':
+  <<: [ *default-job-settings ]
+  rules:
+    - if: $PERFORMANCE_TEST == "1"
+    - when: manual
+      allow_failure: true
+  variables:
+    KUBERNETES_CPU_REQUEST: "24"
+    MINK_DRIVER_ARGS_WEBDRIVER: '["chrome", {"browserName":"chrome","goog:chromeOptions":{"args":["--disable-dev-shm-usage","--disable-gpu","--headless","--no-sandbox"]}}, "http://chrome:9515"]'
+  tags:
+    - performance-test-runner
+  services:
+    - <<: *with-database
+    - <<: *with-chrome
+  script:
+    #  Determine DB driver.
+    - |
+      [[ $_TARGET_DB == sqlite* ]] && export SIMPLETEST_DB=sqlite://localhost/subdirectory/sites/default/files/db.sqlite?module=sqlite
+      [[ $_TARGET_DB == mysql* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == mariadb* ]] && export SIMPLETEST_DB=mysql://$MYSQL_USER:$MYSQL_PASSWORD@database/$MYSQL_DATABASE?module=mysql
+      [[ $_TARGET_DB == pgsql* ]] && export SIMPLETEST_DB=pgsql://$POSTGRES_USER:$POSTGRES_PASSWORD@database/$POSTGRES_DB?module=pgsql
+    - composer install --optimize-autoloader
+    - export OTEL_COLLECTOR="$OTEL_COLLECTOR"
+    - mkdir -p ./sites/simpletest ./sites/default/files ./build/logs/junit /var/www/.composer
+    - chown -R www-data:www-data ./sites ./build/logs/junit ./vendor /var/www/
+    - sudo -u www-data git config --global --add safe.directory $CI_PROJECT_DIR
+    - sudo SIMPLETEST_BASE_URL="http://$HOSTNAME/subdirectory" -u www-data -E -H ./vendor/bin/phpunit -c core --group OpenTelemetry --log-junit=./sites/default/files/simpletest/phpunit-performance.xml

.gitlab-ci/scripts/server-setup.sh

+#!/bin/bash
+
+ln -s $CI_PROJECT_DIR /var/www/html/subdirectory
+sudo service apache2 start
+mkdir -p ./sites/simpletest ./sites/default/files ./build/logs/junit /var/www/.composer
+chown -R www-data:www-data ./sites ./build/logs/junit ./vendor /var/www/
+sudo -u www-data git config --global --add safe.directory $CI_PROJECT_DIR

.gitlab-ci/scripts/test-only.sh

+#!/bin/bash
+
+BASELINE=${CI_MERGE_REQUEST_TARGET_BRANCH_SHA:-$CI_MERGE_REQUEST_DIFF_BASE_SHA}
+
+echo "ℹ️ Changes from ${BASELINE}"
+git diff ${BASELINE} --name-only
+echo "If this list contains more files than what you changed, then you need to rebase your branch."
+
+echo "1️⃣ Reverting non test changes"
+if [[ $(git diff ${BASELINE} --diff-filter=DM --name-only|grep -Ev "*/tests/*"|grep -v .gitlab-ci|grep -v scripts/run-tests.sh) ]]; then
+git diff ${BASELINE} --diff-filter=DM --name-only|grep -Ev "*/tests/*"|grep -v .gitlab-ci|grep -v scripts/run-tests.sh|while read file;do
+  echo "↩️ Reverting $file";
+  git checkout ${BASELINE} -- $file;
+done
+fi
+if [[ $(git diff ${BASELINE} --diff-filter=A --name-only|grep -Ev "*/tests/*"|grep -v .gitlab-ci|grep -v scripts/run-tests.sh) ]]; then
+git diff ${BASELINE} --diff-filter=A --name-only|grep -Ev "*/tests/*"|grep -v .gitlab-ci|grep -v scripts/run-tests.sh|while read file;do
+  echo "🗑️️ Deleting $file";
+  git rm $file;
+done
+fi
+
+echo "2️⃣ Running test changes for this branch"
+EXIT_CODE=0
+if [[ $(git diff ${BASELINE} --name-only|grep -E "Test.php$") ]]; then
+for test in `git diff ${BASELINE} --name-only|grep -E "Test.php$"`; do
+  sudo SIMPLETEST_BASE_URL="$SIMPLETEST_BASE_URL" SIMPLETEST_DB="$SIMPLETEST_DB" MINK_DRIVER_ARGS_WEBDRIVER="$MINK_DRIVER_ARGS_WEBDRIVER" -u www-data ./vendor/bin/phpunit -c core $test --log-junit=./sites/default/files/simpletest/phpunit-`echo $test|sed 's/\//_/g' `.xml || EXIT_CODE=$?;
+done;
+fi
+
+echo "Exiting with EXIT_CODE=$EXIT_CODE"
+exit $EXIT_CODE

.ht.router.php

@@ -24,6 +24,12 @@
  * @see http://php.net/manual/en/features.commandline.webserver.php
  */
 
+if (PHP_SAPI !== 'cli-server') {
+  // Bail out if this is not PHP's Development Server.
+  header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+  exit;
+}
+
 $url = parse_url($_SERVER['REQUEST_URI']);
 if (file_exists(__DIR__ . $url['path'])) {
   // Serve the requested resource as-is.
@@ -33,7 +39,7 @@
 // Work around the PHP bug.
 $path = $url['path'];
 $script = 'index.php';
-if (strpos($path, '.php') !== FALSE) {
+if (str_contains($path, '.php')) {
   // Work backwards through the path to check if a script exists. Otherwise
   // fallback to index.php.
   do {

.htaccess

@@ -3,7 +3,7 @@
 #
 
 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
+<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config|yarn\.lock|package\.json)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
   <IfModule mod_authz_core.c>
     Require all denied
   </IfModule>
@@ -22,13 +22,14 @@ DirectoryIndex index.php index.html index.htm
 AddType image/svg+xml svg svgz
 AddEncoding gzip svgz
 
+# Add correct encoding for webp.
+AddType image/webp .webp
+
 # Most of the following PHP settings cannot be changed at runtime. See
 # sites/default/default.settings.php and
 # Drupal\Core\DrupalKernel::bootEnvironment() for settings that can be
 # changed at runtime.
-
-# PHP 7, Apache 1 and 2.
-<IfModule mod_php7.c>
+<IfModule mod_php.c>
   php_value assert.active                   0
 </IfModule>
 
@@ -37,8 +38,8 @@ AddEncoding gzip svgz
   # Enable expirations.
   ExpiresActive On
 
-  # Cache all files for 2 weeks after access (A).
-  ExpiresDefault A1209600
+  # Cache all files for 1 year after access.
+  ExpiresDefault "access plus 1 year"
 
   <FilesMatch \.php$>
     # Do not allow PHP scripts to be cached unless they explicitly send cache
@@ -139,10 +140,6 @@ AddEncoding gzip svgz
   RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
   # Allow access to test-specific PHP files:
   RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?\.php
-  # Allow access to Statistics module's custom front controller.
-  # Copy and adapt this rule to directly execute PHP files in contributed or
-  # custom modules or to run another PHP application in the same directory.
-  RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics\.php$
   # Deny access to any other PHP files that do not match the rules above.
   # Specifically, disallow autoload.php from being served directly.
   RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]
@@ -153,12 +150,12 @@ AddEncoding gzip svgz
     # Serve gzip compressed CSS files if they exist and the client accepts gzip.
     RewriteCond %{HTTP:Accept-encoding} gzip
     RewriteCond %{REQUEST_FILENAME}\.gz -s
-    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]
+    RewriteRule ^(.*css_[a-zA-Z0-9-_]+)\.css$ $1\.css\.gz [QSA]
 
     # Serve gzip compressed JS files if they exist and the client accepts gzip.
     RewriteCond %{HTTP:Accept-encoding} gzip
     RewriteCond %{REQUEST_FILENAME}\.gz -s
-    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
+    RewriteRule ^(.*js_[a-zA-Z0-9-_]+)\.js$ $1\.js\.gz [QSA]
 
     # Serve correct content types, and prevent double compression.
     RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1,E=no-brotli:1]
@@ -175,7 +172,13 @@ AddEncoding gzip svgz
 
 # Various header fixes.
 <IfModule mod_headers.c>
-  # Disable content sniffing, since it's an attack vector.
+  # Disable content sniffing for all responses, since it's an attack vector.
+  # This header is also set in FinishResponseSubscriber, which depending on
+  # Apache configuration might get placed in the 'onsuccess' table. To prevent
+  # header duplication, unset that one prior to setting in the 'always' table.
+  # See "To circumvent this limitation..." in
+  # https://httpd.apache.org/docs/current/mod/mod_headers.html.
+  Header onsuccess unset X-Content-Type-Options
   Header always set X-Content-Type-Options nosniff
   # Disable Proxy header, since it's an attack vector.
   RequestHeader unset Proxy

INSTALL.txt

 
-Please read core/INSTALL.txt for detailed installation instructions for your
-Drupal website.
+Read core/INSTALL.txt for detailed installation instructions for your Drupal
+website.

autoload.php

@@ -8,7 +8,6 @@
  * @see index.php
  * @see core/install.php
  * @see core/rebuild.php
- * @see core/modules/statistics/statistics.php
  */
 
 return require __DIR__ . '/vendor/autoload.php';

composer.json

@@ -9,46 +9,63 @@
         "chat": "https://www.drupal.org/node/314178"
     },
     "require": {
-        "composer/installers": "^1.9",
+        "composer/installers": "^2.3",
         "drupal/core": "self.version",
         "drupal/core-project-message": "self.version",
         "drupal/core-vendor-hardening": "self.version"
     },
     "require-dev": {
-        "behat/mink": "^1.8",
-        "friends-of-behat/mink-browserkit-driver": "^1.4",
-        "behat/mink-selenium2-driver": "^1.4",
-        "composer/composer": "^2.0.2",
+        "behat/mink": "^1.11",
+        "behat/mink-browserkit-driver": "^2.2",
+        "colinodell/psr-testlogger": "^1.2",
+        "composer/composer": "^2.8.1",
         "drupal/coder": "^8.3.10",
-        "instaclick/php-webdriver": "^1.4.1",
-        "mikey179/vfsstream": "^1.6.8",
-        "phpunit/phpunit": "^8.5.14 || ^9",
-        "phpspec/prophecy": "^1.12",
-        "symfony/css-selector": "^4.4",
-        "symfony/phpunit-bridge": "^5.3.0",
-        "symfony/var-dumper": "^5.3.0",
-        "symfony/error-handler": "^4.4",
         "justinrainbow/json-schema": "^5.2",
-        "symfony/filesystem": "^4.4",
-        "symfony/finder": "^4.4",
-        "symfony/lock": "^4.4",
-        "symfony/browser-kit": "^4.4",
-        "symfony/dom-crawler": "^4.4 !=4.4.5",
-        "easyrdf/easyrdf": "^0.9 || ^1.0"
+        "lullabot/mink-selenium2-driver": "^1.7.3",
+        "lullabot/php-webdriver": "^2.0.5",
+        "mglaman/phpstan-drupal": "^1.2.11 || ^2.0",
+        "micheh/phpcs-gitlab": "^1.1",
+        "mikey179/vfsstream": "^1.6.11",
+        "open-telemetry/exporter-otlp": "^1",
+        "open-telemetry/sdk": "^1",
+        "php-http/guzzle7-adapter": "^1.0",
+        "phpspec/prophecy-phpunit": "^2",
+        "phpstan/extension-installer": "^1.4.3",
+        "phpstan/phpstan": "^1.12.4 || ^2.0.4",
+        "phpstan/phpstan-phpunit": "^1.3.16 || ^2.0.1",
+        "phpunit/phpunit": "^10.5.19",
+        "symfony/browser-kit": "^7.2",
+        "symfony/css-selector": "^7.2",
+        "symfony/dom-crawler": "^7.2",
+        "symfony/error-handler": "^7.2",
+        "symfony/lock": "^7.2",
+        "symfony/var-dumper": "^7.2"
     },
     "replace": {
-        "paragonie/random_compat": "9.99.99",
-        "symfony/polyfill-php70": "*",
         "symfony/polyfill-php72": "*",
-        "symfony/polyfill-php73": "*"
+        "symfony/polyfill-php73": "*",
+        "symfony/polyfill-php74": "*",
+        "symfony/polyfill-php80": "*",
+        "symfony/polyfill-php81": "*",
+        "symfony/polyfill-php82": "*",
+        "symfony/polyfill-php83": "*"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,
     "config": {
         "preferred-install": "dist",
-        "autoloader-suffix": "Drupal9",
+        "sort-packages": true,
         "platform": {
-            "php": "7.3.0"
+            "php": "8.3.0"
+        },
+        "allow-plugins": {
+            "composer/installers": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true,
+            "drupal/core-project-message": true,
+            "drupal/core-vendor-hardening": true,
+            "php-http/discovery": true,
+            "phpstan/extension-installer": true,
+            "tbachert/spi": false
         }
     },
     "extra": {
@@ -84,12 +101,13 @@
     },
     "autoload": {
         "psr-4": {
-            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
+            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer",
+            "Drupal\\Composer\\": "composer"
         }
     },
     "autoload-dev": {
         "psr-4": {
-            "Drupal\\Composer\\": "composer"
+            "Drupal\\PHPStan\\Rules\\": "core/tests/PHPStan/Rules"
         }
     },
     "scripts": {
@@ -98,14 +116,14 @@
         "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
         "drupal-phpunit-upgrade-check": "Drupal\\Core\\Composer\\Composer::upgradePHPUnit",
         "drupal-phpunit-upgrade": [
-            "@composer update phpunit/phpunit --with-dependencies --no-progress",
-            "@composer require phpspec/prophecy-phpunit:^2 --no-progress --no-suggest"
+            "@composer update phpunit/phpunit --with-dependencies --no-progress"
         ],
         "post-update-cmd": [
-            "Drupal\\Composer\\Composer::generateMetapackages"
+            "Drupal\\Composer\\Composer::generateMetapackages",
+            "Drupal\\Composer\\Composer::generateComponentPackages"
         ],
-        "phpcs": "phpcs --standard=core/phpcs.xml.dist --runtime-set installed_paths $($COMPOSER_BINARY config vendor-dir)/drupal/coder/coder_sniffer --",
-        "phpcbf": "phpcbf --standard=core/phpcs.xml.dist --runtime-set installed_paths $($COMPOSER_BINARY config vendor-dir)/drupal/coder/coder_sniffer --"
+        "phpcs": "phpcs --standard=core/phpcs.xml.dist --parallel=\"$( (nproc || sysctl -n hw.logicalcpu || echo 4) 2>/dev/null)\" --",
+        "phpcbf": "phpcbf --standard=core/phpcs.xml.dist --parallel=\"$( (nproc || sysctl -n hw.logicalcpu || echo 4) 2>/dev/null)\" --"
     },
     "repositories": [
         {

composer/Composer.php

@@ -6,14 +6,16 @@
 use Composer\Script\Event;
 use Composer\Semver\Comparator;
 use Composer\Semver\VersionParser;
+use Drupal\Composer\Generator\ComponentGenerator;
 use Drupal\Composer\Generator\PackageGenerator;
 use Symfony\Component\Finder\Finder;
 
 /**
- * Provides static functions for composer script events. See also
- * core/lib/Drupal/Composer/Composer.php, which contains similar
- * scripts needed by projects that include drupal/core. Scripts that
- * are only needed by drupal/drupal go here.
+ * Provides static functions for composer script events.
+ *
+ * See also core/lib/Drupal/Composer/Composer.php, which contains similar
+ * scripts needed by projects that include drupal/core. Scripts that are only
+ * needed by drupal/drupal go here.
  *
  * @see https://getcomposer.org/doc/articles/scripts.md
  */
@@ -30,6 +32,17 @@ public static function generateMetapackages(Event $event): void {
     $generator->generate($event->getIO(), getcwd());
   }
 
+  /**
+   * Update component packages whenever composer.lock is updated.
+   *
+   * @param \Composer\Script\Event $event
+   *   The Composer event.
+   */
+  public static function generateComponentPackages(Event $event): void {
+    $generator = new ComponentGenerator();
+    $generator->generate($event, getcwd());
+  }
+
   /**
    * Set the version of Drupal; used in release process and by the test suite.
    *
@@ -38,9 +51,6 @@ public static function generateMetapackages(Event $event): void {
    * @param string $version
    *   Semver version to set Drupal's version to.
    *
-   * @return string
-   *   Stability level of the provided version (stable, RC, alpha, etc.)
-   *
    * @throws \UnexpectedValueException
    */
   public static function setDrupalVersion(string $root, string $version): void {
@@ -66,9 +76,6 @@ public static function setDrupalVersion(string $root, string $version): void {
    *   Path to root of drupal/drupal repository.
    * @param string $version
    *   Semver version that Drupal was set to.
-   *
-   * @return string
-   *   Stability level of the provided version (stable, RC, alpha, etc.)
    */
   protected static function setTemplateProjectStability(string $root, string $version): void {
     $stability = VersionParser::parseStability($version);
@@ -85,13 +92,14 @@ protected static function setTemplateProjectStability(string $root, string $vers
 
   /**
    * Ensure that the minimum required version of Composer is running.
+   *
    * Throw an exception if Composer is too old.
    */
   public static function ensureComposerVersion(): void {
     $composerVersion = method_exists(ComposerApp::class, 'getVersion') ?
       ComposerApp::getVersion() : ComposerApp::VERSION;
-    if (Comparator::lessThan($composerVersion, '1.9.0')) {
-      throw new \RuntimeException("Drupal core development requires Composer 1.9.0, but Composer $composerVersion is installed. Please run 'composer self-update'.");
+    if (Comparator::lessThan($composerVersion, '2.3.6')) {
+      throw new \RuntimeException("Drupal core development requires Composer 2.3.6, but Composer $composerVersion is installed. Run 'composer self-update'.");
     }
   }
 
@@ -111,9 +119,10 @@ public static function drupalVersionBranch(): string {
    * @param string $root
    *   Path to root of drupal/drupal repository.
    * @param string $subprojectType
-   *   Type of subproject - one of Metapackage, Plugin, or Template
+   *   Type of subproject - one of Metapackage, Plugin, or Template.
    *
    * @return \Symfony\Component\Finder\Finder
+   *   A Finder object.
    */
   public static function composerSubprojectPaths(string $root, string $subprojectType): Finder {
     return Finder::create()

composer/Generator/Builder/DrupalCoreRecommendedBuilder.php

@@ -30,7 +30,15 @@ public function getPackage() {
     }
 
     // Make a list of packages we do not want to put in the 'require' section.
-    $remove_list = ['drupal/core', 'wikimedia/composer-merge-plugin', 'composer/installers'];
+    $remove_list = [
+      'drupal/core',
+      'wikimedia/composer-merge-plugin',
+      'composer/installers',
+      // This package contains no code other than interfaces, so allow sites
+      // to use any compatible version without needing to switch off of
+      // drupal/core-recommended.
+      'psr/http-message',
+    ];
 
     // Copy the 'packages' section from the Composer lock into our 'require'
     // section. There is also a 'packages-dev' section, but we do not need
@@ -41,7 +49,7 @@ public function getPackage() {
       // If there is no 'source' record, then this is a path repository
       // or something else that we do not want to include.
       if (isset($package['source']) && !in_array($package['name'], $remove_list)) {
-        $composer['require'][$package['name']] = $package['version'];
+        $composer['require'][$package['name']] = '~' . $package['version'];
       }
     }
     return $composer;
@@ -51,12 +59,13 @@ public function getPackage() {
    * Returns the initial package metadata that describes the metapackage.
    *
    * @return array
+   *   The initial package metadata.
    */
   protected function initialPackageMetadata() {
     return [
       "name" => "drupal/core-recommended",
       "type" => "metapackage",
-      "description" => "Locked core dependencies; require this project INSTEAD OF drupal/core.",
+      "description" => "Core and its dependencies with known-compatible minor versions. Require this project INSTEAD OF drupal/core.",
       "license" => "GPL-2.0-or-later",
       "conflict" => [
         "webflo/drupal-core-strict" => "*",

composer/Generator/Builder/DrupalDevDependenciesBuilder.php

@@ -34,6 +34,7 @@ public function getPackage() {
    * Returns the initial package metadata that describes the metapackage.
    *
    * @return array
+   *   The initial package metadata.
    */
   protected function initialPackageMetadata() {
     return [

composer/Generator/Builder/DrupalPinnedDevDependenciesBuilder.php

@@ -39,6 +39,7 @@ public function getPackage() {
    * Returns the initial package metadata that describes the metapackage.
    *
    * @return array
+   *   The initial package metadata.
    */
   protected function initialPackageMetadata() {
     return [

composer/Generator/ComponentGenerator.php

+<?php
+
+namespace Drupal\Composer\Generator;
+
+use Composer\IO\IOInterface;
+use Composer\Semver\VersionParser;
+use Composer\Script\Event;
+use Composer\Util\Filesystem;
+use Drupal\Composer\Composer;
+use Drupal\Composer\Generator\Util\DrupalCoreComposer;
+use Drupal\Composer\Util\SemanticVersion;
+use Symfony\Component\Finder\Finder;
+
+/**
+ * Reconciles Drupal component dependencies with core.
+ */
+class ComponentGenerator {
+
+  /**
+   * Relative path from Drupal root to the component directory.
+   *
+   * @var string
+   */
+  protected static $relativeComponentPath = 'core/lib/Drupal/Component';
+
+  /**
+   * Full path to the component directory.
+   *
+   * @var string
+   */
+  protected $componentBaseDir;
+
+  /**
+   * Data from drupal/drupal's composer.json file.
+   *
+   * @var \Drupal\Composer\Generator\Util\DrupalCoreComposer
+   */
+  protected $drupalProjectInfo;
+
+  /**
+   * Data from drupal/core's composer.json file.
+   *
+   * @var \Drupal\Composer\Generator\Util\DrupalCoreComposer
+   */
+  protected $drupalCoreInfo;
+
+  /**
+   * ComponentGenerator constructor.
+   */
+  public function __construct() {
+    $this->componentBaseDir = dirname(__DIR__, 2) . '/' . static::$relativeComponentPath;
+  }
+
+  /**
+   * Find all the composer.json files for components.
+   *
+   * @return \Symfony\Component\Finder\Finder
+   *   A Finder object with all the composer.json files for components.
+   */
+  public function getComponentPathsFinder(): Finder {
+    $composer_json_finder = new Finder();
+    $composer_json_finder->name('composer.json')
+      ->in($this->componentBaseDir)
+      ->ignoreUnreadableDirs()
+      ->depth(1);
+    return $composer_json_finder;
+  }
+
+  /**
+   * Reconcile Drupal's components whenever composer.lock is updated.
+   *
+   * @param \Composer\Script\Event $event
+   *   The Composer event.
+   * @param string $base_dir
+   *   Directory where drupal/drupal repository is located.
+   */
+  public function generate(Event $event, string $base_dir): void {
+    $io = $event->getIO();
+    // General information from drupal/drupal and drupal/core composer.json
+    // and composer.lock files.
+    $this->drupalProjectInfo = DrupalCoreComposer::createFromPath($base_dir);
+    $this->drupalCoreInfo = DrupalCoreComposer::createFromPath($base_dir . '/core');
+
+    $changed = FALSE;
+    /** @var \Symfony\Component\Finder\SplFileInfo $component_composer_json */
+    foreach ($this->getComponentPathsFinder()->getIterator() as $component_composer_json) {
+      $changed |= $this->generateComponentPackage($event, $component_composer_json->getRelativePathname());
+    }
+
+    // Remind the user not to miss files in a patch.
+    if ($changed) {
+      $io->write("If you make a patch, ensure that the files above are included.");
+    }
+  }
+
+  /**
+   * Generate the component JSON files.
+   *
+   * @param \Composer\Script\Event $event
+   *   The Composer event.
+   * @param string $component_pathname
+   *   Relative path to the composer.json file for a component.
+   *
+   * @return bool
+   *   TRUE if the generated component package is different from what is on
+   *   disk.
+   */
+  protected function generateComponentPackage(Event $event, string $component_pathname): bool {
+    $io = $event->getIO();
+    $composer_json_path = $this->componentBaseDir . '/' . $component_pathname;
+    $original_composer_json = file_exists($composer_json_path) ? file_get_contents($composer_json_path) : '';
+
+    // Modify the original data.
+    $composer_json_data = $this->getPackage($io, $original_composer_json);
+    $updated_composer_json = static::encode($composer_json_data);
+
+    // Exit early if nothing changed.
+    if (trim($original_composer_json, " \t\r\0\x0B") === trim($updated_composer_json, " \t\r\0\x0B")) {
+      return FALSE;
+    }
+
+    // Warn the user that a component file has been updated.
+    $display_path = static::$relativeComponentPath . '/' . $component_pathname;
+    $io->write("Updated component file <info>$display_path</info>.");
+
+    // Write the composer.json file back to disk.
+    $fs = new Filesystem();
+    $fs->ensureDirectoryExists(dirname($composer_json_path));
+    file_put_contents($composer_json_path, $updated_composer_json);
+
+    return TRUE;
+  }
+
+  /**
+   * Reconcile component dependencies with core.
+   *
+   * @param \Composer\IO\IOInterface $io
+   *   IO object for messages to the user.
+   * @param string $original_json
+   *   Contents of the component's composer.json file.
+   *
+   * @return array
+   *   Structured data to be turned back into JSON.
+   */
+  protected function getPackage(IOInterface $io, string $original_json): array {
+    $original_data = json_decode($original_json, TRUE);
+    $package_data = array_merge($original_data, $this->initialPackageMetadata());
+
+    $core_info = $this->drupalCoreInfo->rootComposerJson();
+
+    $stability = VersionParser::parseStability(\Drupal::VERSION);
+
+    // List of packages which we didn't find in either core requirement.
+    $not_in_core = [];
+
+    // Traverse required packages.
+    foreach (array_keys($original_data['require'] ?? []) as $package_name) {
+      // Reconcile locked constraints from drupal/drupal. We might have a locked
+      // version of a dependency that's not present in drupal/core.
+      if ($info = $this->drupalProjectInfo->packageLockInfo($package_name)) {
+        $package_data['require'][$package_name] = $info['version'];
+      }
+      // The package wasn't in the lock file, which means we need to tell the
+      // user. But there are some packages we want to exclude from this list.
+      elseif ($package_name !== 'php' && !str_contains($package_name, 'drupal/core-')) {
+        $not_in_core[$package_name] = $package_name;
+      }
+
+      // Reconcile looser constraints from drupal/core, and we're totally OK
+      // with over-writing the locked ones from above.
+      if ($constraint = $core_info['require'][$package_name] ?? FALSE) {
+        $package_data['require'][$package_name] = $constraint;
+      }
+
+      // Reconcile dependencies on other Drupal components, so we can set the
+      // constraint to our current version.
+      if (str_contains($package_name, 'drupal/core-')) {
+        if ($stability === 'stable') {
+          // Set the constraint to ^maj.min.
+          $package_data['require'][$package_name] = SemanticVersion::majorMinorConstraint(\Drupal::VERSION);
+        }
+        else {
+          // For non-stable releases, set the constraint to the branch version.
+          $package_data['require'][$package_name] = Composer::drupalVersionBranch();
+          // Also for non-stable releases which depend on another component,
+          // set the minimum stability. We do this so we can test build the
+          // components. Minimum-stability is otherwise ignored for packages
+          // which aren't the root package, so for any other purpose, this is
+          // unneeded.
+          $package_data['minimum-stability'] = $stability;
+        }
+      }
+    }
+    if ($not_in_core) {
+      $io->error($package_data['name'] . ' requires packages not present in drupal/drupal: ' . implode(', ', $not_in_core));
+    }
+
+    return $package_data;
+  }
+
+  /**
+   * Utility function to encode package json in a consistent way.
+   *
+   * @param array $composer_json_data
+   *   Data to encode into a json string.
+   *
+   * @return string
+   *   Encoded version of provided json data.
+   */
+  public static function encode(array $composer_json_data): string {
+    return json_encode($composer_json_data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
+  }
+
+  /**
+   * Common default metadata for all components.
+   *
+   * @return array
+   *   An array containing the common default metadata for all components.
+   */
+  protected function initialPackageMetadata(): array {
+    return [
+      'extra' => [
+        '_readme' => [
+          'This file was partially generated automatically. See: https://www.drupal.org/node/3293830',
+        ],
+      ],
+      // Always reconcile PHP version.
+      'require' => [
+        'php' => '>=' . \Drupal::MINIMUM_PHP,
+      ],
+    ];
+  }
+
+}

composer/Generator/PackageGenerator.php

@@ -29,7 +29,7 @@ public function __construct() {
   }
 
   /**
-   * Generate Drupal's metapackages whenever composer.lock is updated
+   * Generate Drupal's metapackages whenever composer.lock is updated.
    *
    * @param \Composer\IO\IOInterface $io
    *   Composer IO object for interacting with the user.
@@ -64,6 +64,7 @@ public function generate(IOInterface $io, $base_dir) {
    * Returns a list of metapackage builders.
    *
    * @return BuilderInterface[]
+   *   An array of BuilderInterface objects.
    */
   protected function builders() {
     return [

composer/Generator/Util/DrupalCoreComposer.php

@@ -83,7 +83,7 @@ public function composerLock() {
    */
   public function getRequireDev() {
     $composerJsonData = $this->rootComposerJson();
-    return isset($composerJsonData['require-dev']) ? $composerJsonData['require-dev'] : [];
+    return $composerJsonData['require-dev'] ?? [];
   }
 
   /**
@@ -92,7 +92,7 @@ public function getRequireDev() {
    * @param string $packageName
    *   Name of package to find, e.g. 'behat/mink-selenium2-driver'.
    * @param bool $dev
-   *   TRUE: consider only 'packages-dev'. Default: consider only 'packages'
+   *   TRUE: consider only 'packages-dev'. Default: consider only 'packages'.
    *
    * @return array
    *   Package info from composer.lock.

composer/Metapackage/CoreRecommended/composer.json

 {
     "name": "drupal/core-recommended",
     "type": "metapackage",
-    "description": "Locked core dependencies; require this project INSTEAD OF drupal/core.",
+    "description": "Core and its dependencies with known-compatible minor versions. Require this project INSTEAD OF drupal/core.",
     "license": "GPL-2.0-or-later",
     "conflict": {
         "webflo/drupal-core-strict": "*"
     },
     "require": {
-        "drupal/core": "9.3.x-dev",
-        "asm89/stack-cors": "1.3.0",
-        "composer/semver": "3.2.5",
-        "doctrine/annotations": "1.13.2",
-        "doctrine/lexer": "1.2.1",
-        "doctrine/reflection": "1.2.2",
-        "egulias/email-validator": "2.1.25",
-        "guzzlehttp/guzzle": "6.5.5",
-        "guzzlehttp/promises": "1.5.1",
-        "guzzlehttp/psr7": "1.8.3",
-        "laminas/laminas-diactoros": "2.8.0",
-        "laminas/laminas-escaper": "2.9.0",
-        "laminas/laminas-feed": "2.15.0",
-        "laminas/laminas-stdlib": "3.6.0",
-        "masterminds/html5": "2.7.5",
-        "pear/archive_tar": "1.4.14",
-        "pear/console_getopt": "v1.4.3",
-        "pear/pear-core-minimal": "v1.10.11",
-        "pear/pear_exception": "v1.0.2",
-        "psr/cache": "1.0.1",
-        "psr/container": "1.1.1",
-        "psr/http-factory": "1.0.1",
-        "psr/http-message": "1.0.1",
-        "psr/log": "1.1.4",
-        "ralouphie/getallheaders": "3.0.3",
-        "stack/builder": "v1.0.6",
-        "symfony-cmf/routing": "2.3.3",
-        "symfony/console": "v4.4.30",
-        "symfony/debug": "v4.4.31",
-        "symfony/dependency-injection": "v4.4.31",
-        "symfony/deprecation-contracts": "v2.4.0",
-        "symfony/error-handler": "v4.4.30",
-        "symfony/event-dispatcher": "v4.4.30",
-        "symfony/event-dispatcher-contracts": "v1.1.9",
-        "symfony/http-client-contracts": "v2.4.0",
-        "symfony/http-foundation": "v4.4.30",
-        "symfony/http-kernel": "v4.4.32",
-        "symfony/mime": "v5.3.8",
-        "symfony/polyfill-ctype": "v1.23.0",
-        "symfony/polyfill-iconv": "v1.23.0",
-        "symfony/polyfill-intl-idn": "v1.23.0",
-        "symfony/polyfill-intl-normalizer": "v1.23.0",
-        "symfony/polyfill-mbstring": "v1.23.1",
-        "symfony/polyfill-php80": "v1.23.1",
-        "symfony/process": "v4.4.30",
-        "symfony/psr-http-message-bridge": "v2.1.1",
-        "symfony/routing": "v4.4.30",
-        "symfony/serializer": "v4.4.31",
-        "symfony/service-contracts": "v2.4.0",
-        "symfony/translation": "v4.4.32",
-        "symfony/translation-contracts": "v2.4.0",
-        "symfony/validator": "v4.4.31",
-        "symfony/var-dumper": "v5.3.8",
-        "symfony/yaml": "v4.4.29",
-        "twig/twig": "v2.14.7",
-        "typo3/phar-stream-wrapper": "v3.1.7"
+        "drupal/core": "11.x-dev",
+        "asm89/stack-cors": "~v2.2.0",
+        "composer/semver": "~3.4.3",
+        "doctrine/annotations": "~2.0.2",
+        "doctrine/deprecations": "~1.1.3",
+        "doctrine/lexer": "~2.1.1",
+        "egulias/email-validator": "~4.0.2",
+        "guzzlehttp/guzzle": "~7.9.2",
+        "guzzlehttp/promises": "~2.0.4",
+        "guzzlehttp/psr7": "~2.7.0",
+        "masterminds/html5": "~2.9.0",
+        "mck89/peast": "~v1.16.3",
+        "pear/archive_tar": "~1.5.0",
+        "pear/console_getopt": "~v1.4.3",
+        "pear/pear-core-minimal": "~v1.10.16",
+        "pear/pear_exception": "~v1.0.2",
+        "php-tuf/composer-stager": "~v2.0.0",
+        "psr/cache": "~3.0.0",
+        "psr/container": "~2.0.2",
+        "psr/event-dispatcher": "~1.0.0",
+        "psr/http-client": "~1.0.3",
+        "psr/http-factory": "~1.1.0",
+        "psr/log": "~3.0.2",
+        "ralouphie/getallheaders": "~3.0.3",
+        "revolt/event-loop": "~v1.0.6",
+        "sebastian/diff": "~5.1.1",
+        "symfony/console": "~v7.2.0",
+        "symfony/dependency-injection": "~v7.2.0",
+        "symfony/deprecation-contracts": "~v3.5.1",
+        "symfony/error-handler": "~v7.2.0",
+        "symfony/event-dispatcher": "~v7.2.0",
+        "symfony/event-dispatcher-contracts": "~v3.5.1",
+        "symfony/filesystem": "~v7.2.0",
+        "symfony/finder": "~v7.2.0",
+        "symfony/http-foundation": "~v7.2.0",
+        "symfony/http-kernel": "~v7.2.0",
+        "symfony/mailer": "~v7.2.0",
+        "symfony/mime": "~v7.2.0",
+        "symfony/polyfill-ctype": "~v1.31.0",
+        "symfony/polyfill-iconv": "~v1.31.0",
+        "symfony/polyfill-intl-grapheme": "~v1.31.0",
+        "symfony/polyfill-intl-idn": "~v1.31.0",
+        "symfony/polyfill-intl-normalizer": "~v1.31.0",
+        "symfony/polyfill-mbstring": "~v1.31.0",
+        "symfony/process": "~v7.2.0",
+        "symfony/psr-http-message-bridge": "~v7.2.0",
+        "symfony/routing": "~v7.2.0",
+        "symfony/serializer": "~v7.2.0",
+        "symfony/service-contracts": "~v3.5.1",
+        "symfony/string": "~v7.2.0",
+        "symfony/translation-contracts": "~v3.5.1",
+        "symfony/validator": "~v7.2.0",
+        "symfony/var-dumper": "~v7.2.0",
+        "symfony/var-exporter": "~v7.2.0",
+        "symfony/yaml": "~v7.2.0",
+        "twig/twig": "~v3.19.0"
     }
 }