Composer's new "block known-vulnerable dependencies" functionality has broken our CI pipelines and release artifacts several times since it was added quite recently:
- T411006: Composer 2.9 blocks LibUp js-yaml upgrade on release branch due to vulnerability in firebase/php-jwt
- T415723: CI blocked from installing phpunit by CVE-2026-24765
- T416292: Building MediaWiki 1.43.6 fails due to phpunit security advisory PKSA-z3gr-8qht-p93v (the same root-cause as T415723 above, but filed from a third-party perspective)
- T415834: CVE-2026-24739: Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
- T417722: php-jwt contains weak encryption
We already have processes to notice published vulnerabilities in our dependencies (namely, LibUp). So I propose we turn the composer functionality off.