https://gerrit.wikimedia.org/r/#/c/221179/ is stuck in a weird state because https://packagist.org/packages/wikimedia/ip-set lists "1.0" as the latest version but we are trying to require "1.0.0". Packagist has associated the 1.0.0 tag's hash with the 1.0 version number. It seems like the easiest way to fix this would be to tag a 1.0.1 version, import it into mediawiki/vendor and bump the core requirement.