Aha. AbuseFilter is now bundled, that requires equivset...

Change 785317 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@REL1_38] Re-add wikimedia/equivset

https://gerrit.wikimedia.org/r/785317

Change 785317 merged by Reedy:

[mediawiki/vendor@REL1_38] Re-add wikimedia/equivset

https://gerrit.wikimedia.org/r/785317

I don’t believe this is fixed with with REL1_38 still, the composer update step is missing the dependency at the root, but is there at the vendor subdirectories. These fixes are either incomplete or never made it past RC1

If I grab the 1.38.1 tarball, extract it, the Equivset files are there as expected. They're in .0 too.

reedy@MacBook-Pro Downloads % wget https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.1.tar.gz
--2022-06-29 02:12:55--  https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.1.tar.gz
Resolving releases.wikimedia.org (releases.wikimedia.org)... 91.198.174.192
Connecting to releases.wikimedia.org (releases.wikimedia.org)|91.198.174.192|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 54877814 (52M) [application/x-gzip]
Saving to: ‘mediawiki-1.38.1.tar.gz’

mediawiki-1.38.1.tar.gz                       100%[==============================================================================================>]  52.33M  16.1MB/s    in 3.2s    

2022-06-29 02:12:59 (16.1 MB/s) - ‘mediawiki-1.38.1.tar.gz’ saved [54877814/54877814]

reedy@MacBook-Pro Downloads % zgrep Equivset mediawiki-1.38.1.tar.gz 
Binary file mediawiki-1.38.1.tar.gz matches
reedy@MacBook-Pro Downloads % tar -xvf mediawiki-1.38.1.tar.gz
<snip>
reedy@MacBook-Pro Downloads % ls -al mediawiki-1.38.1/vendor/wikimedia/equivset/
total 56
drwxr-xr-x   9 reedy  staff    288 29 Jun 02:18 .
drwxr-xr-x  36 reedy  staff   1152 29 Jun 02:18 ..
-rw-r--r--   1 reedy  staff    136 20 May 20:50 CODE_OF_CONDUCT.md
-rw-r--r--   1 reedy  staff  18092 20 May 20:50 COPYING
-rw-r--r--   1 reedy  staff   1469 20 May 20:50 README.md
drwxr-xr-x   3 reedy  staff     96 29 Jun 02:18 bin
drwxr-xr-x   3 reedy  staff     96 29 Jun 02:18 data
drwxr-xr-x   5 reedy  staff    160 29 Jun 02:18 dist
drwxr-xr-x   6 reedy  staff    192 29 Jun 02:18 src

composer.json in MediaWiki core is not going to include equivset, because it is not a dependancy needed by MW core. The bundled vendor repo (as shipped in the tarball, or via the git submodule) will.

If you modify core's composer.json (and/or run composer in the mediawiki core folder root) you will wipe out whatever was shipped in the vendor repo.

This is how we've always done it. Similar for OATHAuth's dependancies which have been shipped for a wihle.

It's is expected that if you're running composer, you know what you're probably doing.

You can either run composer update --no-dev inside the AbuseFilter folder yourself, or create a composer.local.json file that the composer merge plugin will use to pull into the combined vendor folder.

https://www.mediawiki.org/wiki/Composer#Using_composer-merge-plugin

Thanks, I’ve fed this detail back to the archlinux distro package manager. And sorry for the false bug…

BTW: There is some text in section ”Usage in MediaWiki core” that might be misleading hinting that the bundled extension dependencies are part of base composer json, or that you can update either the base or vendor directory. At the least, I’ve read and reread it wrong based on your explanation:
https://www.mediawiki.org/wiki/Composer/en

Thanks again for your time

In T306721#8035743, @Skunark wrote:

Thanks, I’ve fed this detail back to the archlinux distro package manager. And sorry for the false bug…

2 reports are better than 0!

In T306721#8035743, @Skunark wrote:

BTW: There is some text in section ”Usage in MediaWiki core” that might be misleading hinting that the bundled extension dependencies are part of base composer json, or that you can update either the base or vendor directory. At the least, I’ve read and reread it wrong based on your explanation:
https://www.mediawiki.org/wiki/Composer/en

Composer managed dependencies are bundled into tarball distributions of MediaWiki and extensions so system administrators do not need to use Composer directly. When installing MediaWiki using Git, dependencies declared in $IP/composer.json can either be installed locally by running composer update --no-dev or the mediawiki/vendor.git repository can be cloned to provide the same libraries used on the Wikimedia production cluster.[1]

Hmm, thanks. Looks like that second sentence could do with a bit of expansion, as it is a little vague to say the least. I'll have a think about it