It is for the same reason invalid as T393824: Mediawiki/includes/http not compatible with psr/http-message version 1.1

The extension does not have to declare correct sub-dependencies, that is the job for composer to take the mininum version that matched.

It can be mitigated by the extension to handle faulty installs, but that makes the migration path for core more complicated (something like 427b6e95853b78db67d782143b3f84b0750165be, but that breaks the other way round when core updates), so keeping the task open for maintenancer of the extension.

https://www.mediawiki.org/wiki/Composer

I did not install this extension via Composer though and the instructions don't say to do so. I simply extracted the directory to the extensions directory and added the appropriate code to LocalSettings.php. The extension itself ships with the newer version of the library and never says anything about needing composer.

I should also add that running composer update after installing the extension doesn't fix the problem. As soon as the cache of the RSS feed expires again I get the error and the site is unusable until I disable the plugin. Re-enabling it after the feed info is cached again makes it work until the next time the cache expires.

It seems that this may be an issue with the Extension Distributor itself as the code in git doesn't include any dependencies (likely so the git repository doesn't have to be updated each time a dependency is, or possibly for licensing). When downloaded, the archive contains the newer version of the library instead of the older version that MW uses. This is also the case with the WSOauth extension.

In T393848#10818913, @Oldiesmann wrote:

It seems that this may be an issue with the Extension Distributor itself as the code in git doesn't include any dependencies (likely so the git repository doesn't have to be updated each time a dependency is, or possibly for licensing). When downloaded, the archive contains the newer version of the library instead of the older version that MW uses. This is also the case with the WSOauth extension.

No it's not. It resolves the dependancies based on what the composer.json has for the extension. Numerous of them have multiple versions of pst/http-message.

Change #1234573 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/GoogleLogin@master] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234573

Change #1234574 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/GoogleLogin@REL1_45] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234574

Change #1234575 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/GoogleLogin@REL1_44] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234575

Change #1234576 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/GoogleLogin@REL1_43] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234576

Change #1234576 merged by jenkins-bot:

[mediawiki/extensions/GoogleLogin@REL1_43] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234576

Change #1234573 merged by jenkins-bot:

[mediawiki/extensions/GoogleLogin@master] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234573

Change #1234575 merged by jenkins-bot:

[mediawiki/extensions/GoogleLogin@REL1_44] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234575

Change #1234574 merged by jenkins-bot:

[mediawiki/extensions/GoogleLogin@REL1_45] composer.json: Explicitly pin psr/http-message to 1.1

https://gerrit.wikimedia.org/r/1234574