[ ← blog / drupal ](/) Nov 20, 2024  ·  \#drupal  ·  3 min read 

# Lenient Composer Plugin officially replaces lenient packages endpoint



Well, it's official. My [Drupal Lenient Composer Plugin](https://github.com/mglaman/composer-drupal-lenient) has allowed the lenient Composer repository endpoint on Drupal.org to be [sunset and removed](https://www.drupal.org/project/project_composer/issues/3482857). I created the `mglaman/composer-drupal-lenient` repository [two years ago](https://github.com/mglaman/composer-drupal-lenient/commit/a013947a668c90626a52374c58d3159d818922d4) at DrupalCon Portland. It is pretty wild how much it has been adopted in just two years. Not only has it allowed the Drupal Association to dismantle some infrastructure, but it is also baked into the [Drupal.org GitLab CI](https://project.pages.drupalcode.org/gitlab_templates/jobs/composer/#lenient-support). The package is pushing over 3,000,000 downloads from [Packagist](https://packagist.org/packages/mglaman/composer-drupal-lenient)!

## Using it Drupal.org GitLab CI

So, I had no idea that my plugin was integrated into the GitLab CI templates. Here is an example from the [documentation](https://project.pages.drupalcode.org/gitlab_templates/jobs/composer/#lenient-support)

```bash
composer (next major):
  variables:
    _LENIENT_ALLOW_LIST: token,pathauto
```

Let's say your module depends on `token` and `pathauto`. You're working on compatibility with Drupal 12 (13, 14, whatever). However, you don't want to be blocked on these modules being fixed or having stable releases. You'd update your `.gitlab-ci.yml` to customize the `composer (next major)` job. Behind the scenes, this will cause `mglaman/composer-drupal-lenient` to be installed and configured.

That's pretty cool.

## What is this "lenient" stuff?

Contributed modules and themes must be updated whenever a new major version of Drupal Core is released. Their `info.yml` and its `core_version_requirement` constraints to specify they work with the latest version of Drupal Core, even if no actual code changes are required to work. The same happens with PHP packages when a new version of PHP is released. They need new releases updating `composer.json` with the latest minor or major version of PHP allowed.

Since Drupal provides a Composer repository for all Drupal modules and themes, a new "lenient" repository was added. The repository essentially removed any constraints on `drupal/core`. This allowed Composer to bypass conflicting constraints on the support version of Drupal Core for any module or theme. It was a way to allow Drupal users to apply patches to modules and upgrade Drupal Core even before their dependencies were fully ready.

I can't remember *why*, but I know I was talking with [Jakob Perry,](https://www.drupal.org/u/japerry) and the next thing I knew, there was a wild idea to encapsulate the concept as a Composer plugin. The problem with the Composer repository endpoint is that it worked *for everything* rather than specific packages. My Composer plugin allows you to opt into individual packages.

Now we're here. A wild idea that has become an integral part of Drupal's major version upgrade process.

 

  ![](/themes/custom/mglaman/images/headshot.webp)Thanks for reading

I write about Drupal, PHP, and the quiet infrastructure behind large sites — caching, config, and testing. New posts land every week or two.

 [Subscribe via RSS →](/rss.xml) [About me →](/about-me) 

 



 

  [← Older

Next stages for the Drupal Starshot trial experience

 ](/blog/next-stages-drupal-starshot-trial-experience) [Newer →

Restrict Composer dependency updates to only patch releases

 ](/blog/restrict-composer-dependency-updates-only-patch-releases)