In Parsoid repository, any CI job fails with:
- Root composer.json requires phpunit/phpunit 10.5.62 (exact version match: 10.5.62 or 10.5.62.0), found phpunit/phpunit[10.5.62] but these were not loaded, because they are affected by security advisories ("PKSA-5jz8-6tcw-pbk4"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.https://integration.wikimedia.org/ci/job/quibble-vendor-mysql-php83/65661/console
In core repository, any CI job fails with:
- Root composer.json requires phpunit/phpunit 9.6.34 (exact version match: 9.6.34 or 9.6.34.0), found phpunit/phpunit[9.6.34] but these were not loaded, because they are affected by security advisories ("PKSA-5jz8-6tcw-pbk4"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.This is annoying because the only fixes in https://github.com/advisories/GHSA-qrr6-mg7r-m243 for this are for phpunit 12.5.22 and 13.1.6 and we're still using phpunit 9 and 10. In fact, we don't really have a plan for covers-validator past PHP 11 or 12: https://github.com/oradwell/covers-validator/issues/44