drupal/core vs. drupal/core-recommended

Question

I've got a question regarding drupal/core and drupal/core-recommended. So drupal/core-recommended uses fixed versions of the packages, which the corresponding core version was tested with. And yes it does make sense that this prevents bugs introduced by version differences of let's say different versions of Symfony packages for example.

But on the other hand, let's say you install a dev version of a module or any other third-party library with composer, which explicitly needs a different version of a Symfony component than drupal/core-recommended, these locked versions of the core dependencies will cause trouble, as the third party library/the module could not get installed due to version conflicts.

So how would one deal with this kind of situation when using drupal/core-recommended?

Answer 1

It's "core-recommended" as in "recommended to avoid having dependency-related trouble with core."

Drupal core (and some of the contributed modules, but not all) has a variety of automated tests that are run to make sure that everything is working as expected. However, Drupal also needs dependencies to run. If you use different versions of the dependencies that were not tested, there might be a bug and the tests might not pass. core-recommended contains the specific dependencies that were used to test a given version of Drupal core.

By using core-recommended, you are guaranteed to get the same dependencies that were used to release that version of Drupal core, and Drupal core is only released when those tests pass. So, you can be more confident when you are deploying your site because you know that your combination of core + dependencies is verified to work according to the tests.

let's say you install a dev version of a module or any other third party library with composer, which explicitly needs a different version of a Symfony component than drupal/core-recommended,

It's relatively rare for a contributed module to need a specific version of a Symfony component. When you do need to use such a module and you switch from core/recommended to core, you might experience some Symfony-related or other dependency-related bugs because some of the dependencies may require changes in core that have not been made yet. So when you do this, you are now responsible for running the tests, and if you encounter bugs you may have to search the core issue queue and apply patches, etc.

As for dev modules, it's never recommended to install dev modules on production, so whenever you install a dev module, you are taking responsibility for testing into your own hands.

TLDR: Recommended means "recommended because it passed the tests." These are the recommended dependencies because they are known to work, but of course you can try to use others if you like. But, if you don't use the recommended dependencies and then you find a bug and think, "hey, core is broken, let's file an issue!", you should first check with core-recommended to make sure the issue isn't specific to the contrib module/dependency that required you to remove core-recommended.

Answer 2

Let's look at the README of drupal/core-recommended. This basically explains it all.

Require this project instead of the drupal/core subtree split in order to guarentee that all of the dependencies from drupal/core will be included in your Drupal site at exactly the same version that was tested with the version of Drupal you are currently using.

The consequences of not using this project is that Drupal's dependencies may "float up" to more recent versions than were tested with Drupal when you use Composer to upgrade your Drupal site. Occasionally, new dependency versions introduce bugs in Drupal. While these sorts of errors are usually corrected fairly quickly, it can still be quite disruptive to be one of the first people encountering one of these bugs. Using the recommended dependencies avoids this problem by only using dependency versions that have already been tested with Drupal.

Also in the docs on Using Composer to Install Drupal and Manage Dependencies.

Run composer require drupal/core-recommended to install Drupal core into your preferred directory structure. You could also require the drupal/core package, if you did not want to lock all of Drupal core's dependencies to known-good versions.