Replace roave/security-advisories with Composer's built-in advisory blocking #308

Since its update on 2026-10-29, roave/security-advisories also conflicts with PHP itself: php <8.2.35 | >=8.3,<8.3.36 | >=8.4,<8.4.27 | >=8.5,<8.5.12. Composer can no longer install the dependencies of a repository that requires it on any older PHP version. That breaks every CI job testing on PHP 7.2–8.1, as well as runners that lag a patch release.

#305 works around this by removing the package in CI when the running PHP falls inside the conflict. It reads the conflict with composer show --available, which fails in wp-cli-dev because its path repositories are only cloned later. The step then reports conflicts with php (none), keeps the package, and the unit tests on PHP 7.4–8.1 fail in every wp-cli-dev pull request (for example wp-cli/wp-cli-dev#85).

Proposal

Remove roave/security-advisories from every repository, and remove the CI workaround.

The package no longer adds anything. Since Composer 2.9, Composer refuses to install or update to any package version with a known security advisory, by default. The release post says that if you use roave/security-advisories, "this new feature replaces it fully and you can remove the dependency on this package." Composer 2.10 moved the setting into the policy config block, still enabled by default.

Composer's check covers our dependencies, not the PHP version Composer runs on. That is the part we care about: we don't control the PHP version on a CI runner, we just need to test on it. The test runners are short-lived, are not reachable from outside, and setup-php ships builds with security fixes backported (shivammathur/setup-php#1139).

Composer 2.9 or later is required for this protection

Contributors need Composer 2.9 or later to keep this protection locally. Older Composer versions install without the check.

That is a reasonable requirement. Composer 2.9 and later require PHP 7.2.5, the same as every Composer 2.x release since 2.3, so any PHP version that can run current WP-CLI tooling can run it. I checked Composer 2.9.0 on PHP 7.2.34, 7.4.33, 8.0.30, 8.1.34, 8.2.35, 8.3.36, 8.4.27 and 8.5.12: it runs on each and blocks a package with known advisories (guzzlehttp/guzzle 7.4.0) on each. Only a PHP version older than 7.2.5 is stuck on an older Composer, and such a version gets no security patches anyway. CI already installs the latest Composer (2.11.1 at the moment).

Changes

• Remove the roave/security-advisories workaround #309 (merge last): remove the "Drop roave/security-advisories" step from reusable-unit.yml and reusable-functional.yml
• Remove roave/security-advisories wp-cli#6441
• Remove roave/security-advisories wp-cli-bundle#1184
• Remove roave/security-advisories and require Composer 2.9 wp-cli-dev#88, which also documents the Composer 2.9 requirement
• Remove roave/security-advisories wp-cli-tests#396
• Remove roave/security-advisories php-cli-tools#205