$ composer outdated wikimedia/composer-merge-plugin contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins Do you trust "wikimedia/composer-merge-plugin" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] ? y - add package to allow-plugins in composer.json and let it run immediately n - add package (as disallowed) to allow-plugins in composer.json to suppress further prompts d - discard this, do not change composer.json and do not allow the plugin to run ? - print help Do you trust "wikimedia/composer-merge-plugin" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y <snip> $ git diff diff --git a/composer.json b/composer.json index 7ed377e6..1194d72e 100644 --- a/composer.json +++ b/composer.json @@ -5,7 +5,10 @@ "optimize-autoloader": true, "prepend-autoloader": false, "vendor-dir": ".", - "sort-packages": true + "sort-packages": true, + "allow-plugins": { + "wikimedia/composer-merge-plugin": true + } }, "prefer-stable": true, "require": {
https://github.com/composer/composer/releases/tag/2.2.0
https://getcomposer.org/doc/06-config.md#allow-plugins
We probably want to add wikimedia/composer-merge-plugin to allow-plugins in composer.json for MW core and MediaWiki-Vendor by default.