Phan has been introduced recently and iirc it requires some configuration files in the repository. @Addshore should we restrict phan to only run on master branch for now?

* Installation request for mediawiki/anti-spoof dev-master

One of the extension composer.json requires the package mediawiki/anti-spoof. That is a leftover from experimenting with composer, that should not be used to express the dependency since that confuses the composer merge plugin. With recent MediaWiki versions that is handled in extension.json.

That is due to AbuseFilter having:

{
  "require": {
    "mediawiki/anti-spoof": "dev-master"
  }
}

That should be removed entirely.

For the composer issue, see also the same explanation at T201794#4524998 :]

That is due to AbuseFilter having:

composer.json

{
  "require": {
    "mediawiki/anti-spoof": "dev-master"
  }
}

That should be removed entirely.

@hashar I'm not entirely sure where are you seeing that composer.json file but fwiw the dependency on anti-spoof was removed from AbuseFilter over a year ago https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/383717

That is in the REL1_27 branch. So probably we should remove that require in the branch.

In T202671#4672323, @dmaza wrote:

That is due to AbuseFilter having:

composer.json

{
  "require": {
    "mediawiki/anti-spoof": "dev-master"
  }
}

That should be removed entirely.

@hashar I'm not entirely sure where are you seeing that composer.json file but fwiw the dependency on anti-spoof was removed from AbuseFilter over a year ago https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/383717

That commit doesn't remove it ;)

The web just get more confusing as you go back through git blame

https://github.com/wikimedia/mediawiki-extensions-AbuseFilter/commit/e981f23b92fbb25634fb295486ef9aeeaeeb5dd8
https://github.com/wikimedia/mediawiki-extensions-AbuseFilter/commit/8ffebe35020b19b3aad4862c481d08a0a200cece

Based on https://packagist.org/packages/mediawiki/anti-spoof I wonder if we can just do dev-REL1_27

Patch incoming!

Change 467836 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/extensions/AbuseFilter@REL1_27] Stop making AbuseFilter in REL1_27 track dev-master of AntiSpoof

https://gerrit.wikimedia.org/r/467836

Yup, that works. Really, it should be done in extension.json, but we don't have that functionality in REL1_27 - https://github.com/wikimedia/mediawiki/blob/REL1_27/docs/extension.schema.json but things are less broken (as long as composer isn't trying to install antispoof even though it's already installed...

Still broken, but it's then broken a per T202669: Thanks REL1_30 and REL1_27 failing with session token errors instead

Though, we can just remove the line entirely too based on https://github.com/wikimedia/mediawiki-extensions-AbuseFilter/blob/REL1_27/AbuseFilter.parser.php#L1692-L1711

Change 467836 merged by Reedy:
[mediawiki/extensions/AbuseFilter@REL1_27] Don't install AntiSpoof extension via composer

https://gerrit.wikimedia.org/r/467836