(Why the tarball contains require-dev dependencies at all is another question.)

It's not in as a dev dependancy, it's in because the mediawiki-vendor repo used by Wikimedia has it for some other extensions that require it

See also T172927

Change 390270 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_29] Bump justinrainbow/json-schema development dependency to ~5.2

https://gerrit.wikimedia.org/r/390270

^ Patch above fixes the immediate issue, until we decide longer term how we're actually going to build vendor folders for tarball releases in future

Change 390270 merged by jenkins-bot:
[mediawiki/core@REL1_29] Bump justinrainbow/json-schema development dependency to ~5.2

https://gerrit.wikimedia.org/r/390270

Should we mark this as resolved and have the long term discussion on T172927: mediawiki/vendor is bloated for tarball releases?

Thanks for the quick fix!

@Kghbln FYI

I was wondering why suddenly people appear on the mailing-l with [0] and claiming that the setup from 1.28 to 1.29 is broken.

- The requested package justinrainbow/json-schema (installed at 5.2.0, required as ~3.0) is satisfiable by justinrainbow/json-schema[5.2.0] but these conflict with your requirements or minimum-stability.

• Does 1.30 has the same issue?
• When is a 1.29.2 patch release planned?
• How can this be avoided in future?

[0] https://sourceforge.net/p/semediawiki/mailman/message/36080889/

In T180143#3752310, @mwjames wrote:

• Does 1.30 has the same issue?
• When is a 1.29.2 patch release planned?
• How can this be avoided in future?

1. No. You could check this for yourself very easily - https://github.com/wikimedia/mediawiki/blob/REL1_30/composer.json#L56
2. Very soon
3. Try reading the task where T172927 is mentioned numerous times as a solution to both this and other composer/vendor related issues?

@Reedy Do you think your response in tone is appropriate? I don't think so!

No. You could check this for yourself very easily

A simple, no is sufficient, no need for a hyperbolic connotation as in " You could check this for yourself very easily..." because I know I could but between establishing a fact of "no"and me looking at the file are two different things.

Very soon

Means exactly what?

Try reading the task where T172927 is mentioned numerous times as a solution to both this and other composer/vendor related issues?

Again, on the matter of "Try reading the task .... mentioned numerous times", just link to the task which would be sufficient and doesn't carry an underlying tone of annoyance.