Make sure composer.json in mediawiki/vendor matches with mediawiki/core. Or put another way, when running composer of core its deployment branch it should result in a vendor directory that matches with mediawiki/core. This might also involve creating a composer.local.json in core that merges composer.json from all extensions during branching (need to modify the tools that are used for cutting the deployment branch).
The following dependencies do exist in vendor but are not listed under require(-dev) in core directly:
```
"firebase/php-jwt": "2.1.0",
"kzykhys/pygments": "1.0",
"ruflin/elastica": "2.2.0",
"symfony/process": "2.7.3",
```
These were added in require-dev to core because they broke running the tests ( fixed in https://gerrit.wikimedia.org/r/#/c/240067/ ) :
```
"monolog/monolog": "1.14.0",
"nmred/kafka-php": "0.1.4",
"wikimedia/avro": "1.7.7",
```