As seen in T295173: Interface 'Wikimedia\NormalizedException' not found we removed something from MediaWiki-Vendor in MW-1.37-release that shouldn't have been.
But as CI runs and installs all the things it needs on release branches using composer, we didn't really notice until a user reported it.
We should at least have one job that doe some sort of validation/testing using the branches vendor repo (because we use them in tarballs), to make sure all the necessary dependancies are there
We are no more testing release branches with mediawiki/vendor since T189560. At some point vendor release branches have been adjusted to only ship dependencies of extensions included in the mediawiki tarball and our CI config (zuul) does not make distinction between tarballed and not tarballed extension. As a result extensions not in the tarball would have missing dependencies.
Thus CI for releases branches solely relies on composer to ship the dependencies and providing them through vendor is not supported.
The point is we have no job currently verifying that even MW core itself in the release branch work with the relevant vendor repo (never mind bundled extensions). And we should have one.
Don't need to use the vendor release branch for everything... But at least for MW core patches to REL branches, we should have one job that at least checks that the basics work...
T306721: mediawiki 1.38-rc.0 Wikimedia\Equivset\Equivset not found being an example where this would have ben useful for MW-1.38-release
CI was silently installing it when running patches... So we didn't notice.
T309377: CVE-2022-29248: Update "guzzlehttp/guzzle" to version 6.5.6 was another I caught by checking git logs..