Issue updating extensions on 1.8

Impulsive5

I am trying to upgrade my install but I am getting an error message. I believe Flarum itself is up to date. I am trying to make sure my extensions are up to date so I can replace some with the new fof versions. I am not trying to upgrade to v2 because I use a bunch of Clark's extensions that are incompatible.

$ composer update --prefer-dist --no-plugins --no-dev -a --with-all-dependencies
Loading composer repositories with package information
Warning: the packages key 'kilowhat/flarum-ext-audit-pro' doesn't match the name defined in the package metadata 'kilowhat/flarum-ext-audit' in repository https://floxum.com/composer
Updating dependencies
Your requirements could not be resolved to an installable set of packages.


  Problem 1
    - Root composer.json requires flarum/core ^1.8 -> satisfiable by flarum/core[v1.8.16].
    - Root composer.json requires kilowhat/flarum-ext-rich-embeds ^1.2 -> satisfiable by kilowhat/flarum-ext-rich-embeds[1.2.0, ..., 1.4.0].
    - flarum/core v1.8.16 requires monolog/monolog ^1.16.0 -> satisfiable by monolog/monolog[1.16.0, ..., 1.27.1].
    - google/apiclient[v2.0.0, ..., v2.0.3] require firebase/php-jwt ~2.0|~3.0 -> found firebase/php-jwt[2.0.0, v2.1.0, v2.2.0, v3.0.0] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.1.0, ..., v2.1.3] require firebase/php-jwt ~2.0|~3.0|~4.0 -> found firebase/php-jwt[2.0.0, v2.1.0, v2.2.0, v3.0.0, v4.0.0] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.2.0, ..., v2.12.1] require firebase/php-jwt ~2.0||~3.0||~4.0||~5.0 -> found firebase/php-jwt[2.0.0, v2.1.0, v2.2.0, v3.0.0, v4.0.0, v5.0.0, ..., v5.5.1] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.12.2, ..., v2.14.0] require firebase/php-jwt ~2.0||~3.0||~4.0||~5.0||~6.0 -> found firebase/php-jwt[2.0.0, v2.1.0, v2.2.0, v3.0.0, v4.0.0, v5.0.0, ..., v5.5.1, v6.0.0, ..., v6.11.1] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.15.0, ..., v2.16.1] require firebase/php-jwt ~6.0 -> found firebase/php-jwt[v6.0.0, ..., v6.11.1] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.17.0, ..., v2.18.4] require firebase/php-jwt ^6.0 -> found firebase/php-jwt[v6.0.0, ..., v6.11.1] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - google/apiclient[v2.19.0, ..., v2.19.3] require monolog/monolog ^2.9||^3.0 -> satisfiable by monolog/monolog[2.9.0, ..., 2.11.0, 3.0.0, ..., 3.10.0].
    - kilowhat/flarum-ext-rich-embeds[1.2.0, ..., 1.4.0] require google/apiclient ^2.0 -> satisfiable by google/apiclient[v2.0.0, ..., v2.19.3].
    - kilowhat/flarum-ext-rich-embeds[1.2.4, ..., 1.3.2] require enshrined/svg-sanitize ^0.15 -> found enshrined/svg-sanitize[0.15.0, ..., 0.15.4] but these were not loaded, because they are affected by security advisories ("PKSA-4g5g-4rkv-myqs"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - You can only install one version of a package, so only one of these can be installed: monolog/monolog[1.16.0, ..., 1.27.1, 2.0.0, ..., 2.11.0, 3.0.0, ..., 3.10.0].

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.
Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems.

$ php  flarum info
Flarum core: 1.8.16
PHP version: CLI: 8.5.7, Web: 8.5.7
PHP memory limit: CLI: 128M, Web: unable to detect
MySQL version: 11.8.8-MariaDB
Loaded extensions: Core, date, lexbor, pcre, zlib, filter, hash, json, uri, Zend OPcache, random, readline, Reflection, SPL, session, standard, bcmath, bz2, ctype, curl, libxml, fileinfo, gd, iconv, intl, mbstring, openssl, pcntl, PDO, pgsql, posix, dom, SimpleXML, tokenizer, xml, xmlwriter, zip, exif, mysqlnd, Phar, xmlreader, mysqli, pdo_mysql, apcu, msgpack, igbinary, imap, redis
+-------------------------------------------+---------+--------+------------+
| Flarum Extensions                         |         |        |            |
+-------------------------------------------+---------+--------+------------+
| ID                                        | Version | Commit | Notes      |
+-------------------------------------------+---------+--------+------------+
| flarum-flags                              | v1.8.2  |        |            |
| flarum-tags                               | v1.8.8  |        |            |
| flarum-approval                           | v1.8.2  |        |            |
| flarum-suspend                            | v1.8.6  |        |            |
| flarum-mentions                           | v1.8.5  |        |            |
| flarum-subscriptions                      | v1.8.1  |        |            |
| flarum-sticky                             | v1.8.2  |        |            |
| fof-formatting                            | 1.1.2   |        |            |
| flarum-bbcode                             | v1.8.0  |        |            |
| fof-user-bio                              | 1.4.3   |        |            |
| fof-split                                 | 1.1.1   |        |            |
| fof-merge-discussions                     | 1.4.3   |        |            |
| fof-impersonate                           | 1.2.0   |        |            |
| flarum-lock                               | v1.8.2  |        |            |
| v17development-seo                        | v2.0.9  |        |            |
| fof-pages                                 | 1.0.8   |        |            |
| flamarkt-backoffice                       | 0.1.4   |        |            |
| fof-byobu                                 | 1.4.6   |        |            |
| fof-forum-widgets-core                    | 1.0.0   |        |            |
| fof-user-directory                        | 1.4.1   |        |            |
| fof-follow-tags                           | 1.2.9   |        |            |
| flarum-likes                              | v1.8.1  |        |            |
| the-turk-stickiest                        | 3.0.1   |        | Deprecated |
| sycho-lite-youtube                        | v0.1.1  |        |            |
| ralkage-hcaptcha                          | 1.3.0   |        |            |
| kilowhat-rich-embeds                      | 1.4.0   |        |            |
| kilowhat-audit-pro                        | 1.7.1   |        |            |
| justoverclock-be-active-user-indicator    | 0.1.0   |        |            |
| fof-upload                                | 1.8.11  |        |            |
| fof-terms                                 | 1.5.0   |        |            |
| fof-sitemap                               | 2.6.0   |        |            |
| fof-polls                                 | 2.3.3   |        |            |
| fof-nightmode                             | 1.6.0   |        |            |
| fof-move-posts                            | v1.1.1  |        |            |
| fof-moderator-notes                       | 1.3.1   |        |            |
| fof-links                                 | 1.4.0   |        |            |
| fof-linguist                              | 1.1.6   |        |            |
| fof-ignore-users                          | 1.2.1   |        |            |
| fof-horizon                               | 1.0.6   |        |            |
| fof-geoip                                 | 1.5.3   |        |            |
| fof-forum-stats-widget                    | 1.0.1   |        |            |
| fof-drafts                                | 1.2.14  |        |            |
| fof-discussion-views                      | 1.0.0   |        |            |
| fof-default-user-preferences              | 1.2.2   |        |            |
| fof-best-answer                           | 1.7.1   |        |            |
| fof-anti-spam                             | 1.1.4   |        |            |
| flectar-fancybox                          | 2.1.0   |        |            |
| flarum-statistics                         | v1.8.1  |        |            |
| flarum-markdown                           | v1.8.1  |        |            |
| flarum-lang-english                       | v1.8.0  |        |            |
| flarum-extension-manager                  | v1.0.8  |        |            |
| flarum-emoji                              | v1.8.1  |        |            |
| ecnu-im-sticky-sidenav                    | v1.1.0  |        |            |
| club-1-content-permissions                | v1.0.1  |        |            |
| clarkwinkelmann-username-blacklist        | 1.0.0   |        |            |
| clarkwinkelmann-selective-mediaembed      | 1.0.1   |        |            |
| clarkwinkelmann-post-stream-search        | 1.1.0   |        |            |
| clarkwinkelmann-mass-actions              | 1.1.2   |        |            |
| clarkwinkelmann-lock-likes                | 1.1.1   |        |            |
| clarkwinkelmann-follow-tags-prompt        | 1.1.0   |        |            |
| clarkwinkelmann-emojionearea              | 1.1.1   |        |            |
| clarkwinkelmann-email-whitelist           | 1.0.0   |        |            |
| clarkwinkelmann-discussion-open-position  | 1.1.0   |        |            |
| clarkwinkelmann-advanced-search-highlight | 1.0.3   |        |            |
| askvortsov-moderator-warnings             | v0.6.3  |        |            |
| askvortsov-auto-moderator                 | v0.1.3  |        |            |
| acpl-my-tags                              | 1.4.0   |        |            |
+-------------------------------------------+---------+--------+------------+
Base URL: 
Installation path: /www/html
Queue driver: redis
Session driver: redis (Code override. Configured to file)
Scheduler status: Active
Mail driver: smtp
Debug mode: off

IanM

Impulsive5 you have a few extensions that need replacing with their new equivalents.

Go to admin -> basics -> scroll down -> click 'check now' under 'abandoned extensions'. This will show you which ones to remove and replace.

Overall, the main cause of the error here is something that has a dep on google/apiclient. It's not obvious to me right now which extension that it, but a good start would be to remove the "dead" extensions - it might just clear the pathway for you

Impulsive5

The only extension that shows abandoned is the-turk-stickiest.

Does the composer output I posted indicate that kilowhat/flarum-ext-rich-embeds is causing that update to be blocked?

IanM

Impulsive5 Does the composer output I posted indicate that kilowhat/flarum-ext-rich-embeds is causing that update to be blocked?

It's possible. To confirm if it is, you could try removing it temporarily via composer (or extension manager).

Impulsive5 The only extension that shows abandoned is the-turk-stickiest.

This is strange, at least these have replacements now, and should be being marked as such:

`v17development/flarum-seo
askvortsov-moderator-warnings

There could be more, this is just off the top of my head

huseyinfiliz

Impulsive5 You can uninstall the-turk/flarum-stickiest and install huseyinfiliz/stickiest instead. I have spoken with The Turk (Hasan Özbey), and I am now maintaining the extension.

To make the upgrade to 2.x as smooth as possible, it is important to perform this migration while you are still on the 1.x series.

Doing so will ensure that you won't encounter any issues when upgrading to 2.x in the future.

clarkwinkelmann

Impulsive5 based on this output, I believe the problem is related to a dependency of kilowhat/flarum-ext-rich-embeds.

google/apiclient cannot be updated to its latest version, because it's incompatible with Flarum's logging driver. The older version of that dependency requires firebase/php-jwt which has an active security advisory, so Composer refuses to install it.

I would suggest to disable the block-insecure feature entirely, because I have seen it causing issues with other extensions as well, where the advisories are irrelevant to the actual use case, and it just causes a lot of troubleshooting nightmare:

composer config audit.block-insecure false

Or, if you want to just ignore that particular advisory, you can update your composer.json. I looked through the Composer documentation and relevant articles, but I cannot find any command to do this automatically, it seems like the only way is to edit the composer.json file manually:

{
    "config": {
        "audit": {
            "ignore": {
                "PKSA-y2cr-5h3j-g3ys": "Rich Embeds does not generate JWT keys."
            }
        }
    }
}

That particular advisory seems to be disputed on its merits, and in any case it doesn't affect any of the code actually used by Rich Embeds.

Impulsive5

clarkwinkelmann I ignored that specific advisory just as you described and everything updated successfully.

huseyinfiliz I will do so. Thanks.