From 81bb2f303070da49368252ce056f29a4489e6c5f Mon Sep 17 00:00:00 2001 From: Alain Schlesser Date: Fri, 30 Oct 2026 19:36:41 +0100 Subject: [PATCH] Remove roave/security-advisories Composer 2.9+ blocks packages with known security advisories by default, which fully replaces this package. Since its latest update, the package also conflicts with every PHP version without the newest security release, so it can't be installed on the older PHP versions we test on. Co-Authored-By: Claude Opus 5.5 --- .readme-partials/INSTALLATION.md | 4 +++- composer.json | 3 --- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.readme-partials/INSTALLATION.md b/.readme-partials/INSTALLATION.md index b36d31c..01317fd 100644 --- a/.readme-partials/INSTALLATION.md +++ b/.readme-partials/INSTALLATION.md @@ -6,7 +6,9 @@ In order to make code changes to WP-CLI, you'll need to set up this `wp-cli-dev` 2. Install all Composer dependencies for a complete `wp-cli-bundle` setup, while symlinking all of the previously cloned packages into the Composer `vendor` folder. 3. Symlink all folder in `vendor` into corresponding `vendor` folders in each repository, thus making the centralized functionality based on Composer available in each repository subfolder. -Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/), PHP, and a functioning MySQL or MariaDB server on your local machine. +Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/) 2.9 or later, PHP, and a functioning MySQL or MariaDB server on your local machine. + +Composer 2.9 and later refuse to install package versions with known security advisories, which protects the development environment from vulnerable dependencies. That is why WP-CLI doesn't rely on the `roave/security-advisories` package for this anymore. Older Composer versions install without this check. See the [Composer 2.9 release post](https://blog.packagist.com/composer-2-9/) for details. Once the prerequisites are met, clone the GitHub repository and run the installation process: diff --git a/composer.json b/composer.json index cbf8d49..c772766 100644 --- a/composer.json +++ b/composer.json @@ -256,9 +256,6 @@ "wp-cli/wp-config-transformer": "dev-main as 1.2.x-dev", "wp-cli/wp-super-cache-cli": "dev-main" }, - "require-dev": { - "roave/security-advisories": "dev-latest" - }, "suggest": { "psy/psysh": "Enhanced `wp shell` functionality" },