Change Details

Composer's new "block known-vulnerable dependencies" functionality has broken our CI pipelines and release artifacts several times since it was added quite recently: * {T411006} * {T415723} * {T415834} * {T416292} We already have processes to notice published vulnerabilities in our dependencies (namely, LibUp). So I propose we turn the composer functionality off.

Composer's new "block known-vulnerable dependencies" functionality has broken our CI pipelines and release artifacts several times since it was added quite recently: * {T411006} * {T415723} * {T416292} (the same root-cause as T415723 above, but filed from a third-party perspective) * {T415834} * {T417722} We already have processes to notice published vulnerabilities in our dependencies (namely, LibUp). So I propose we turn the composer functionality off.

Composer's new "block known-vulnerable dependencies" functionality has broken our CI pipelines and release artifacts several times since it was added quite recently: * {T411006} * {T415723} * {T416292} (the same root-cause as T415723 above, but filed from a third-party perspective) * {T415834} * {T416292}7722} We already have processes to notice published vulnerabilities in our dependencies (namely, LibUp). So I propose we turn the composer functionality off.