Keeping dependencies up to date
This page is for designers maintaining a theme that bundles or requires other work.
The inventory
Keep a list (for example in THIRD-PARTY.md) with, for each dependency: name, version, where it comes from, license,
and how it is loaded.
| Kind | Example | How to update |
|---|---|---|
| Bundled library | A slider script | Replace the file with the new release |
| Bundled font or icon set | An open-source font | Replace the files; check the license again |
| Library from Exponential | jQuery through ezjscore | Comes with Exponential; adapt your code (JavaScript library upgrades) |
| Required extension | A layouts engine | composer outdated on the test installation |
Step by step, each maintenance cycle
- On the test installation run
composer outdatedand read the list for your theme's dependencies. - Check the release notes of each bundled library for security fixes.
- Update one dependency at a time, test, commit with
Updated: <name> <version>. - Check the license of the new version; licenses change sometimes (Third-party fonts, icons and libraries).
- Update the inventory.
Remove what you no longer use
A library nobody loads still ships with every install and may carry known vulnerabilities: Exponential removed the old
jQuery UI 1.10.3 for exactly that reason. Remove unused files in a release with a Removed: entry.
Related pages
- Maintenance calendar
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.