In this Gerrit change, Libraryupgrader tried to update js-yaml to 3.14.2, 4.1.1 in WikibaseQualityConstraints on the REL1_39 branch, in order to resolve CVE-2025-64718. However, gate-and-submit failed:
[27.0MiB/9.57s] Your requirements could not be resolved to an installable set of packages.
[27.0MiB/9.57s]
Problem 1
- Root composer.json requires firebase/php-jwt ^5.2.0, found firebase/php-jwt[v5.2.0, v5.2.1, v5.3.0, v5.4.0, v5.5.0, v5.5.1] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-2kqm-ps5x-s4f5") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
[24.9MiB/9.57s]
Update to apply merge settings failed, reverting ./composer.lock to its original content.If I understand correctly, this is Composer 2.9’s Automatic Security Blocking at work – blocking us from fixing another vulnerability (in a separate package ecosystem). This seems hardly ideal.
(Note that the equivalent changes on REL1_43 and REL1_44 went through without issue – presumably those branches happen to already have a newer php-jwt version.)