We have pear/net_smtp 1.8.1 - https://github.com/wikimedia/mediawiki-vendor/blob/master/composer.json#L43

So patch incoming

Is this meaning in MW core? As if so, there is no pear/net_socket (anymore?) in composer.json

But obviously we still want it explicitly in vendor/composer.json

Yeah, just vendor, hence the tag. ;-)

We explicitly tag in vendors compare.json. Including dependencies

I don’t see what’s still to do here