Drupal 9 readiness meeting / 1 June 2020 [#3144493]

Meeting will happen in #d9readiness on drupal.slack.com.

Hello and welcome to this Drupal 9 readiness meeting!

This meeting:
➤ Is for core and contributed project developers as well as people who have integrations and services related to core. Site developers who want to stay in the know to keep up-to-date for the easiest Drupal 9 upgrade of their sites are also welcome.
➤ Usually happens every Monday at 18:00 UTC.
➤ Is done over chat.
➤ Happens in threads, which you can follow to be notified of new replies even if you don’t comment in the thread. You may also join the meeting later and participate asynchronously!
➤ Has a public agenda anyone can add to: `https://www.drupal.org/project/drupal/issues/3144493`
➤ *Transcript will be exported and posted* to the agenda issue. For anonymous comments, start with a :bust_in_silhouette: emoji. To take a comment or thread off the record, start with a :no_entry_sign: emoji.

0️⃣ Who is here today? Comment in the thread below to introduce yourself.

hestenet (he/him)	Tim with the DA, in Portland, OR :slightly_smiling_face:
surabhi.gokte	Surabhi, India :wave::skin-tone-2:
pingwin4eg	Mike, Ukraine :wave:
atul4drupal	Atul India
Nitesh	hi Nitesh from India
kristen_pol	Kristen, Coarsegold, CA, USA
jyoti mishra	Jyoti Mishra, India:blush:
nerdstein	Adam, PA, USA
dww	Derek, US. Black Lives Matter
Tejas Shah	hii all Tejas India
vuil	Ilcho, Bulgaria, EU
shaal	Ofer Shaal, Florida :sunglasses:
Gábor Hojtsy (he/him)	Gábor, Hungary
tedbow	Ted, NY, USA
mixologic	Ryan, from the DA
dan2k3k4	:wave: Dan, Zürich
mohrerao	Kiran, India
greg.1.anderson	Greg, SF
rishabhthakur	Rishabh From India
catch	Nat from the UK
baddysonja	Late to the party, but reading everything now :smile:
larowlan	lee, late b/c timezones
jungle	Jungle, Chongqing, China, very late, due to timezone.
VladimirAus	Vladimir, Australia
JayKandari	Jaideep, India. Getting in sync.. :slightly_smiling_face: late due to timezone. :slightly_smiling_face:

1️⃣ Do you have suggested topics you are looking to discuss? Post in this thread and we’ll open threads for them as appropriate.

hestenet (he/him)	DA Support for Launch day - how can we help?
surabhi.gokte	do you know about celebratedrupal.org? if yes, have you added photos, videos or celebration links?
Gábor Hojtsy (he/him)	@Nitesh what is the relation to Drupal 9's release?
Nitesh	oo sorry
Tejas Shah	can we take this
Tejas Shah	#3027122: Set "Referrer-Policy" header to prevent leaking secret tokens in URLs
mixologic	@Tejas Shah same as Gabor said above: https://drupal.slack.com/archives/CDDD98AMN/p1591034837431200?thread_ts=...
tedbow	Update on Project Update Bot
mixologic	Drupalci Testing changes upcoming
shaal	@Gábor Hojtsy (he/him) is there more to discuss / clarify PHPunit8 upgrades? when to do it and when not to?
xjm	https://drupal.slack.com/archives/CDDD98AMN/p1591036394461900?thread_ts=...
xjm	https://drupal.slack.com/archives/CDDD98AMN/p1591036743463900?thread_ts=...
VladimirAus	Updating help. Do we need separate issue or bot to list all Drupal 8 references in help to update.
Gábor Hojtsy (he/him)	Not sure if there is an issue. It would be good to have one yeah :)

2️⃣ Drupal 9.0.0 is to be released in 2 days! :tada:

pingwin4eg	So this is the final D9 readiness meeting, I suppose.
Gábor Hojtsy (he/him)	I don’t think this will be the final one, there is a lot to do with contrib, and core may not be entirely perfect :wink:
jyoti mishra	This is our last d9-readiness meting?
nerdstein	WOO HOO!
Gábor Hojtsy (he/him)	We can still use this meeting to track progress and help people with D9 porting, the tools used, etc.
Nitesh	thanks @Gábor Hojtsy (he/him)
jyoti mishra	Great @Gábor Hojtsy (he/him)
Gábor Hojtsy (he/him)	BTW Drupal 8.9.0, 8.8.7 and 7.71 are also all planned to be released on the same day as Drupal 9.0.0, so it will be a tumultuous day.
atul4drupal	This sounds like a BIG - DAY
dww	Other than planning parties, is there anything technical that still needs to / can happen to prepare the releases?
Gábor Hojtsy (he/him)	@dww Technically I think the 9.0.* critical issues list would give us the best views of that, I am not aware of which of these if any are targeted to be fixed before the stable release https://www.drupal.org/project/issues/drupal?priorities=400&version=all_...
Gábor Hojtsy (he/him)	@catch or @xjm are tracking that
xjm	Code freeze is in about 16h, but we should already be careful with what we commit
xjm	There are a few issues where folks could help out
xjm	We got #3143722: Update symfony/http-foundation to 3.4.35 (a security release) in already which is excellent. I think there are a couple other issues for dep updates but not sure their status
dww	So dep updates are your preference for what we should work on if we have time?
dww	Any other wish-list items to help? Would like to focus on things that will be allowed and welcome.
xjm	We could use an issue to update the JavaScript dependencies on 8.9.x and 8.8.x, the ones that are insecure from yarn audit. (Same on 9.0 but I need to commit the stylelint issue first.)
xjm	(Or I will ask catch to)
xjm	Then there is still the situation with #3134648: [backport, needs scheduling] Don't pin the composer/installers version in drupal/core-recommended which I think we might not have time to resolve in 16h :stuck_out_tongue:
xjm	(The former is more than just a core issue; we need docs work etc.)
xjm	Also we may need an issue to update the phpunit bridge constraint to 4.1.12, similarly to what we did for http-foundation
xjm	Or at least, "Investigate constraints for symfony/dependency-injection and symfony/phpunit-bridge and see if they can be updated to 4.1.12"
xjm	@Gábor Hojtsy (he/him) could you open a new thread for "who can work on each of those two proposed dependency issues?"
catch	I've been keeping an eye on critical bugs and there don't seem to be any new horrible ones since the release candidate.

3️⃣ Looking for translators for the press release and help to spread internationally

Gábor Hojtsy (he/him)	@pixelite posted the call to translations in various channels, reach out to her in #d9launch to get involved
andypost	Thanks to raising! is there any links about slack to follow?
andypost	just got v2 of russian release notes today and it looks good enough
Gábor Hojtsy (he/him)	https://drupal.slack.com/archives/CDDD98AMN/p1591034879432800?thread_ts=...
VladimirAus	Yep, Russian version doubled reviewed and should be done.

4️⃣ celebratedrupal.org is live and looking for your submissions: videos, photos (artwork, selfies, etc) and events

Gábor Hojtsy (he/him)	@surabhi.gokte raised this :slightly_smiling_face:
Gábor Hojtsy (he/him)	there are various fun ones, eg. I like https://celebratedrupal.org/video/fun/building-drupal-9 :smile:
jyoti mishra	will post selfie today itself:sunglasses:
dan2k3k4	Looking forward to your submissions. We moderate the content so it'll show as draft for images and videos but then we publish as soon as possible
surabhi.gokte	And don't get confused with the timezone while submitting event or looking at any other event :sweat_smile: The time is shown according to what your system settings are (edited)
baddysonja	So many great submissions already. :drupaleurope-heart::dancerbanana:
VladimirAus	I added DO group to promote the events: https://groups.drupal.org/drupal-9-release-parties similar to Drupal 8 launch

5️⃣ What does the Drupal Association do on launch day?

Gábor Hojtsy (he/him)	@hestenet (he/him) raised this :slightly_smiling_face:
Gábor Hojtsy (he/him)	I don’t know if the Drupal 9 release is scheduled within the day (edited)
Gábor Hojtsy (he/him)	but of course monitoring for any packaging problems would be great especially with 3 Drupal 8/9 releases and a Drupal 7 release on the same day
Gábor Hojtsy (he/him)	the front page hero will need to be updated
Gábor Hojtsy (he/him)	the Drupal project page will likely need updating in some form
hestenet (he/him)	Yup - so sounds like mostly have a checklist ready, and be available on call in case of issues.
Gábor Hojtsy (he/him)	Screenshot 2020-06-01 at 20.14.29.png
Gábor Hojtsy (he/him)	these things on the project page in particular ^^^
drumm	Those update automatically as releases are made.
Gábor Hojtsy (he/him)	ok great :slightly_smiling_face:
drumm	If we want to do a general visual refresh of the page, then that would be a project.
Gábor Hojtsy (he/him)	no
drumm	#3117535: Update Drupal core project page (node/3060) for Drupal 9's release and Drupal 8 EOL is the issue for this
hestenet (he/him)	@xjm For the purposes of blocking off time on our calendars to be available --- any thought as to what time in the morning the whole release process will begin to kick off?
xjm	Gábor just asked this in committer Slack. We can’t guarantee a specific time; this entire 48h is the release window. We have a few pending criticals we’re trying to resolve and we have to follow weird release strategies for 8.8 and 8.9 before we do 9.0
xjm	So if it’s at all possible, I’d have stuff staged up and be ready to press a button when it happens
xjm	It could be late afternoon
hestenet (he/him)	Fair enough.

6️⃣ State of contrib is amazing, but look at your modules for quick wins :slightly_smiling_face:

Gábor Hojtsy (he/him)	https://dev.acquia.com/drupal9/deprecation_status has the latest data
Gábor Hojtsy (he/him)	25% of contributed projects are explicitly declare Drupal 9 compatibility
Gábor Hojtsy (he/him)	woot!
Gábor Hojtsy (he/him)	another 33% could theoretically declare it with an info.yml file change
Gábor Hojtsy (he/him)	that is 2955 projects
dww	I have a few (mostly unused) modules that still need info update and new release. I’ll try to get those out today.
Gábor Hojtsy (he/him)	@tedbow and @mixologic worked on making the background scripts run the full upgrade status on projects, so this now includes deprecated twig syntax use, deprecated Drupal library use, hook_theme, etc.
Gábor Hojtsy (he/him)	unlike in previous datasets
Gábor Hojtsy (he/him)	so where this says there is only an info file problem, it is even more likely there is only an info file change missing
vuil	I'll working on that... (edited)
larowlan	@mikemiles86 ^

7️⃣ Project Update bot updates

Gábor Hojtsy (he/him)	Raised by @tedbow
tedbow	The script to make the patches ran Friday but I worked on some changes since then so I am not going to run the bot until I finish those which should be later today
tedbow	fixes include #3142922: The Project Update bot should set '^8.7.7 \|\| ^9' or '^8.8 \|\| ^9' for core_version_requirment
tedbow	this will allow setting ^8.8 \|\| ^9 if we know replacements that need 8.8 were made(also 8.7.7). while no updating if they already require higher like 8.8.3
shaal	@tedbow did you have a chance to upgrade to drupal-rector v0.5.5 ?
tedbow	I will do that today. and do some spot checking. thanks
shaal	:+1:
tedbow	Also fixed the script that reverts files that only had whitespace changes(rector bug not sure if fixed but doens't hurt)
Gábor Hojtsy (he/him)	it was fixed I think
tedbow	anyways it makes no changes if fixed. so doesn't hurt to leave in
tedbow	also #3144394: Update title of Rector Bot issues to mention Drupal 9 so far going with the title I suggested in the issue
tedbow	Also added a bunch of tests for the internal php lib #3143953: Add tests for `project_analysis_utils` internal library
tedbow	Just reached :100:commits :tada: https://www.drupal.org/u/project-update-bot
Gábor Hojtsy (he/him)	Thanks @tedbow for your work on this!
kristen_pol	@tedbow Unrelated to readiness but is there any discussion of using the bot for things like coding standard fixes?
tedbow	I think there was the idea to see how this goes and see the reaction. I would say it is still too early to tell but think it would be good idea.My opinion would be to wait until we can proper per project opt-in(opt-out?) by maintainers. So it would only run on project where maintainers want it.there was time crunch for Drupal 9 but I don't think there is time crunch for coding standards fixes
kristen_pol	Makes sense, thanks. Glad it's being considered.

8️⃣ Upcoming Drupalci Testing changes

Gábor Hojtsy (he/him)	@mixologic raised this
mixologic	Hi. Im planning on making some changes to drupalci that alters the way that contrib module testing works.
mixologic	The problem now is we start with 9.0.x of drupal core, and then composer require a module to test it.
mixologic	The issue is that in order for composer to be able to gather that module, it has to declare that it is compatible with drupal 9, even though that might not yet be true.
mixologic	So, we’re going to invert the composer requirement, such that uses git to gather the module under test, then patches the module, and then composer require’s it into the System under test.
mixologic	(using a local path repository)
mixologic	This may end up introducing a requirement that modules must have a composer.json in order for drupalci to test them.
jyoti mishra	cool
mixologic	In a perfect world, composer.json becomes an optional way to manage dependencies in drupal core in 9.1, and deprecates managing dependencies in info.yml for drupal 10. (#3005229: Provide optional support for using composer.json for dependency metadata) And then it becomes required for all projects that wish to use drupalci for testing to use composer.json. Not there yet, but that is the direction we want to head.
andypost	when contrib has no dependencies it will be hard to maintain more or less "comformant" composer.json files via modules and themes
andypost	OTOH this way explored in #3005229: Provide optional support for using composer.json for dependency metadata
andypost	I think it would be useful to manage some notes via drupal-org UI to composer.json (at least for releases) (edited)
mixologic	@andypost not sure what you mean by hard to maintain?. It would just be a standard composer.json with no dependencies in it. One per project.
mixologic	There is still the endless challenge of drupal projects containing more than one extension, and having the ability to have a dependency on a submodule, and also for submodules to have dependencies that the ‘project’ does not have.
dww	I presume it’s not easy (possible?) for drupalci to “composer facade-ify” the git check out that’s used as the local path repo for building the test site?
dww	Ie if there’s no composer.json in git, generate the one we do for tagged releases?
mixologic	well, thats what we’re going to try
mixologic	however, that still might not work, because, if the patch is trying to modify dependencies, or modify core_version_requirement in just an info.yml file, the facade will not know about it.
mixologic	And we cannot do what the facade does on drupalci, because the facade is dependent upon the entirety of the drupal.org project database.
mixologic	so the best we can do is grab the last thing the facade knew about.
mixologic	but again, a patch that is going to add d9 compatibility and also fix a couple of things to make that work (i.e. move some deprecations) couldnt work without a composer.json
mixologic	we’d be back to the situation we’re in now, where a project has to commit the d9 compatibility statement first, saying its compatible, when it isnt, yet.
mixologic	But, everything becomes much, much easier once we get rid of dependency management in info.yml entirely.
dww	I mean, not the end of the world if we start requiring composer.json for contrib that wants drupalci testing... my vote, not that it matters, is to cap yourself at ~half day. If the rabbit hole is still heading down, bail and just require composer.json for drupalci testing.
mixologic	Yeah, Im more like “going to invert this first, and if it still doesnt fix testing for projects that do not have a composer.json, tell them its required”
mixologic	but.. I might be able to make it work easily enough by pulling in the facade, and just changing the drupal/core requirement, which might make it work for 90% of the cases where theres just no dependencies at all.
mixologic	The other, entirely different way to solve this, is to not start with core at all
mixologic	Its to invert testing entirely. Git clone the contrib module. Composer install, run tests.
mixologic	(again, that requires composer.json, and requires that every module state its core compatibility). Im not sure that a contrib module can have drupal/core as a dependency and actually run tests, but that would be ideal.
mixologic	But that might also require contrib modules to be their own template of sorts,
mixologic	and have composer installers, and the scaffold, etc in their composer.json.
mixologic	but it has the added advantage of not having this weird scenario where we’re really testing drupal 9 with a certain module installed, vs testing the module with drupal as a depednency.
mixologic	which sounds circular, but its how almost every other php system is tested.

9️⃣ When to do PHPUnit 8 upgrades in contrib projects

Gábor Hojtsy (he/him)	@shaal raised this
Gábor Hojtsy (he/him)	I think this was about the backported phpunit BC methods vs. what is not backported, etc?
shaal	right
shaal	Rector can upgrade code to phpunit8, but upgrading to phpunit8 might break compatability with drupal8 ?
dww	I thought the distinction was phpunit8 stuff breaks on PHP 7.0? So it’s not compatibility with core itself, but about the supported PHP versions?
shaal	¯\_(ツ)_/¯
shaal	I don't know and it wasn't so clear to me, which is why I raised this topic
Gábor Hojtsy (he/him)	#3142267: Allow the full list of deprecations from PHPUnit8Warning to respect the --suppress-deprecations behavior on DrupalCI was the related issue discussed before
Gábor Hojtsy (he/him)	it used to be a core issue
Gábor Hojtsy (he/him)	well, its still a core issue
Gábor Hojtsy (he/him)	previous title was “[9.0 only?] Allow the full list of deprecations from PHPUnit8Warning to respect the --suppress-deprecations behavior on DrupalCI”
Gábor Hojtsy (he/him)	the issue about lack of possible cross-compatibility with Drupal 8.7 and 9.0 for contribs (edited)
Gábor Hojtsy (he/him)	but 8.7 goes unsupported in 2 days

🔟 Need an issue to update the JavaScript dependencies on 8.9.x and 8.8.x, the ones that are insecure from yarn audit

Gábor Hojtsy (he/him)	Raised by @xjm
xjm	(Also on 9.0.x but we need to commit the stylelint issue first)
dww	If no one gets to this before me, I can work on this later today (~4 hours from now)
dww	@xjm Did a search for "yarn dependencies" in the core queue. What's the relationship between what you're asking for in this thread vs. the following:#3118741: [Security] Update yarn dependencies to fix security issues?
dww	3118741 seems closest to what you're asking for, no? That's pretty similar to the results I'm seeing locally:299 vulnerabilities found - Packages audited: 870Severity: 296 Low \| 1 Moderate \| 2 High
xjm	I don't know that there's an issue yet -- we need different patches per branch
xjm	For 9.0 and 9.1 we should wait until the stylelint issue is in, hopefully later todayt
xjm	But we can make patches for 8.9 and 8.8 now
dww	I'm 95% sure #3118741: [Security] Update yarn dependencies to fix security issues is the right issue.
xjm	@dww We can hijack it back to D8, sure
dww	And is making the patch as simple as "yarn upgrade"?
xjm	I think we only want to update the actually insecure things, especially on 8.8
xjm	(Which will of course do any required dep updates for those)
dww	@xjm If you have a moment, would you be willing to look at #3118741: [Security] Update yarn dependencies to fix security issues#comment-13657751 and advise if that's the right direction?
xjm	"299 vulnerabilities found" :rolling_on_the_floor_laughing: holy cantankerous ocelots
xjm	Oh npm ecosystem, how I loathe thee
dww	I'm ignoring Low for now. High can only be fixed by "yarn upgrade nightwatch"
dww	Moderate can only be solved by "yarn upgrade eslint"
dww	Scope radar is freaking out over here.
xjm	OK I think we need to phone an expert here
xjm	. (edited)
xjm	Bah meant to send ot channel
xjm	Does anyone know the best practice for updating things that are insecure with yarn audit, short of upgrading everything? #3118741: [Security] Update yarn dependencies to fix security issues#comment-13657751
dww	Re: scope: The 9.1.x "moderate" is the same vulnerability as 8.9.x: eslint > espree > acornSo perhaps it makes sense to have a separate issue for "Update eslint yarn dependency" that can be for all branches?I don't know what you want. :100: defer to your wishes. Please advise. ;) Thanks!
xjm	@dww So for 9.1 and 9.0 it's just that the patches will conflict with the existing stylelint issue and the other existing 9.0.x issue
xjm	So we need D9 patches that are applied on top of those once they go in
xjm	But D8 doesn't have this complication
dww	So you want 1 big patch for D8 with both nightwatch and eslint upgrade?
xjm	@dww Yep, let's start with that :thumbsup:
xjm	@lauriii is off today, but pinging him here for tomorrow
catch	stylelint is in.
xjm	OK cool, so that means we can address #3143289: Upgrade babel dependencies (yarn run build:js broken) next I guess?
xjm	FWIW I was able to avoid the above error by downgrading either Node or Yarn, I forget which
xjm	Anyone up to help with #3143289: Upgrade babel dependencies (yarn run build:js broken) ?
xjm	BTW @larowlan ^ You had ideas for automating this so maybe you can help with the first manual version?
dww	@xjm Just uploaded D9 patch for just eslint (moderate) update.
larowlan	yeah I had a chat with @tedbow about things we could leverage from the project update bot thing, but it sounds like that was pretty bespoke. The mink bits of it that interact with d.o sound like they could be re-used
xjm	@larowlan But I mean manually the specific update steps we should take now for 8.8.7 and 8.9.0 :slightly_smiling_face:
xjm	@larowlan See #3118741: [Security] Update yarn dependencies to fix security issues
xjm	Gotta say, this "I will helpfully let you depend on infinite different versions of a library" thing of yarn's is annoying
larowlan	oh k
xjm	If I'm reading this right, simply trying to update to secure versions of nightwatch and eslint adds 60 additional dependencies. whyyyyyyyy
xjm	Who wants to take bets on how many are three-line functions from that sindrewhatsit person
xjm	@lauriii Yeah we could use your feedback on #3118741: [Security] Update yarn dependencies to fix security issues. We were just trying to update the insecure cruft before the final 8.8.7 release and before 8.9.0, but simply trying to do a security update for nightwatch and eslint seems to result in 60 new dependencies being added. This also isn't yet addressing the low-risk vulnerabilities.
xjm	And here I thought it'd just be a "simple" update
dww	Yeah, seems messy and yuck. Not sure how much more helpful I can be on this.
jungle	Oh npm ecosystem, how I loathe theenode, iojs, deno (Deno is a runtime for JavaScript and TypeScript…), npm, yarn, such a divided node-ish community.
jungle	Fortunately, there is no Paldru.

1️⃣ :one: Who can help investigate constraints for symfony/dependency-injection and symfony/phpunit-bridge and see if they can be updated to 4.1.12?

Gábor Hojtsy (he/him)	@xjm raised this
xjm	(Similar to #3143722: Update symfony/http-foundation to 3.4.35 (a security release), just dev dependencies so slightly different)
xjm	. wrong thread (edited)
Tejas Shah	I would like to audit this but might need a little guidance of how to do this
xjm	@Tejas Shah So the first step is to file the issue -- then try to use similar steps to #3143722: Update symfony/http-foundation to 3.4.35 (a security release)
Tejas Shah	@xjm will do thank you
Tejas Shah	Hi @xjm in D8.8 i need to investigate this rgt
Tejas Shah	also the issue ill create should be for D8.8 rgt
xjm	@Tejas Shah I would check all three branches. Definitely 8.8 and probably 8.9. 9.0 is probably OK but we should check.
xjm	@Tejas Shah Can you paste what you see locally here?
xjm	In the email we have from GitHub, it says:
xjm	Dependencysymfony/phpunit-bridge Version>= 4.0.0 < 4.1.12 Upgrade to~> 4.1.12Defined incomposer.jsonVulnerabilitiesCVE-2019-10912 Moderate severity
Tejas Shah	sure what i see locally is as belowD9.0 we already have this version in composer json so i guess no need to update under require-dev section "symfony/phpunit-bridge": "^5.0" "symfony/dependency-injection": "^4.3\|^5.0",D8.8 we need to investigate by updating as we have below version Under require section "symfony/dependency-injection": "~3.4.26",under require-dev section "symfony/phpunit-bridge": "^4.4@dev"
xjm	Yeah that seems very weird; wouldn't ^4.4@dev already include the release? Hmmm
xjm	I wonder if it's confused by "symfony/dependency-injection": "~3.4.26",` and we need to fix that
xjm	We should look at the actual CVE and see if there was a 3.4.x release for it..
xjm	https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-ef...
xjm	It says that it was fixed in 3.4.26. So.... why is GitHub scolding us :slightly_smiling_face:
xjm	@Tejas Shah Maybe the issue we should file is "Investigate why GitHub detects insecure versions of dependency-injection and phpunit-bridge"
Tejas Shah	ok sure will create this issue mentioning the details shared here (edited)
Tejas Shah	@xjm can you share or update the issue later with the issues concern shared by github with you in the email ok (edited)
xjm	@Tejas Shah Yep, O
xjm	I will paste in a screenshot of the report
Tejas Shah	#3144544: Add roave/security-advisories as a dev dependency
Tejas Shah	please update
xjm	@Tejas Shah There, added -- can you add the list of which versions each branch is using?
jungle	Hi @xjm I think, we can ignore it, checked versions locked in all 4 branches, and extracted the actual versions which have known security vulnerabilities from the composer.json of https://github.com/Roave/SecurityAdvisories, and compared. Nothing wrong on our-side.See the comment for more #3144544: Add roave/security-advisories as a dev dependency#comment-13658081 (edited)
jungle	Re-scoped it to “Add roave/security-advisories as a dev dependency” #3144544: Add roave/security-advisories as a dev dependency#comment-13658115 see the comment for more. thanks!
jungle	https://drupal.slack.com/archives/C392CHBEW/p1591066734426400