fix(drupal): hold decoupled_router below 2.0.7

[Decipher]

Closes nothing here — the fix belongs in druxt. This holds the line until
that release exists.

What breaks

Decoupled Router 2.0.7 (2026-08-22) gave
RouterPathTranslatorSubscriber::onPathTranslation() a : void return
type. druxt 1.2.1 declares its three subscribers without one, so PHP
rejects the override:

Declaration of Drupal\druxt\EventSubscriber\ViewsPathTranslatorSubscriber::onPathTranslation($event)
must be compatible with ...RouterPathTranslatorSubscriber::onPathTranslation($event): void

The failure mode is the bad part. drush cr aborts, Drupal keeps serving
from the old container, and druxt's subscribers are silently absent — a
site that quietly stops resolving paths rather than one that falls over.

Tracked upstream as #3618675, critical.

Why this repository was exposed

drupal/druxt requires drupal/decoupled_router: ^2.0, and nothing here
required it directly, so 2.0.7 was in range and only composer.lock stood
between an update and a broken site:

$ composer update drupal/decoupled_router
  - Upgrading drupal/decoupled_router (2.0.6 => 2.0.7)

A fresh composer install was always fine. composer update, or a
Renovate bump on its own schedule, was not.

The constraint

"drupal/decoupled_router": "^2.0 <2.0.7", added as a direct requirement.

A range rather than an exact 2.0.6: composer validate --strict rejects
exact constraints on a package that follows semantic versioning, and this
repository runs that in CI.

Verified

Built a site with 2.0.7 and druxt from the upstream compatibility branch
to confirm the diagnosis end to end:

	Result
druxt 1.2.1 + decoupled_router 2.0.7	fatal, as above
druxt 1.2.x + decoupled_router 2.0.7	container builds
translate-path?path=/	HTTP 200, resolves to the frontpage view

And after the pin:

• composer update drupal/decoupled_router — nothing to modify
• composer update — decoupled_router untouched
• composer validate --strict — passes

Removing it

When druxt releases a version carrying the fix, drop the constraint and
re-lock. Two things land with it: the : void return types, and three
instanceof CacheableJsonResponse guards that 2.0.7 made unreachable by
typing getResponse().

Summary by CodeRabbit

• Bug Fixes

  • Added a compatibility constraint for the Drupal decoupled routing component to prevent incompatible updates.
  • Updated the Drupal project template to include the required routing dependency.

• Chores

  • Reformatted project configuration for improved readability without changing its behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d9193a8f-989d-44c0-abf7-465ecab2bf28

📥 Commits

Reviewing files that changed from the base of the PR and between 8280619 and d597047.

⛔ Files ignored due to path filters (1)

• drupal/composer.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• drupal/composer.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Drupal project template adds a bounded drupal/decoupled_router dependency, documents the compatibility constraint, and reformats unchanged Composer configuration arrays.

Changes

Dependency Constraint

Layer / File(s)	Summary
Add bounded router dependency drupal/composer.json, CHANGELOG.md	The project requires drupal/decoupled_router with ^2.0 <2.0.7. The changelog documents the incompatible return-type change and the future removal condition.
Reformat Composer configuration drupal/composer.json	The installer paths and Drupal project message arrays use multi-line formatting. Their values and semantics remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d5970

The PR applies a bounded dependency constraint to prevent an incompatible release from being selected. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency constraint that prevents drupal/decoupled_router 2.0.7 installation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-decoupled-router

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.24%. Comparing base (8280619) to head (d597047).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #160   +/-   ##
========================================
  Coverage    90.24%   90.24%           
========================================
  Files           13       13           
  Lines         2132     2132           
  Branches       103      103           
========================================
  Hits          1924     1924           
  Misses         203      203           
  Partials         5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.