Varbase AI 2.0.14 cannot be installed: drupal/ai ~1.2.0 is blocked by security advisories

Problem/Motivation

Varbase AI 2.0.13, 2.0.14 and 2.0.x-dev require drupal/ai: ~1.2.0. Composer 2.9 and later block packages with security advisories by default, and every drupal/ai 1.2.x release is covered by one, so 2.0.14 cannot be installed:

drupal/varbase_ai 2.0.14 requires drupal/ai ~1.2.0 -> found drupal/ai[dev-1.2.x, 1.2.0-alpha1, ..., 1.2.x-dev] but these were not loaded, because they are affected by security advisories ("SA-CONTRIB-2025-119", "SA-CONTRIB-2026-028", "SA-CONTRIB-2026-055", "SA-CONTRIB-2026-054", "SA-CONTRIB-2026-119", "SA-CONTRIB-2026-120", "SA-CONTRIB-2026-266", "SA-CONTRIB-2026-267", "SA-CONTRIB-2026-268", "SA-CONTRIB-2026-269", "SA-CONTRIB-2026-273", "SA-CONTRIB-2026-270", "SA-CONTRIB-2026-271", "SA-CONTRIB-2026-272").

With drupal/varbase_ai: ~2.0.0, as Varbase 10.1 requires it, Composer quietly falls back to 2.0.0-beta1, so new sites get a beta. The fixed drupal/ai releases are 1.4.11 and 1.5.2 (SA-CONTRIB-2026-266 to -273).

Steps to reproduce

1. Use Composer 2.9 or later (seen with 2.11.2) on a Drupal ~11.4.0 project.
2. Run composer require drupal/varbase_ai:2.0.14
3. Composer refuses with the error above.

Proposed resolution

Require drupal/ai: ~1.5.2, the line the Varbase 11 AI recipes already lock. Varbase AI calls no drupal/ai API itself, and a dry run of the full Varbase 10.1.x stack resolves with advisory blocking on (drupal/ai 1.5.2, AI Agents 1.3.5, AI Integration - ECA 1.0.1).

Varbase AI Agents 1.0.4 and later still pin drupal/ai: ~1.2.0, so Composer picks Varbase AI Agents 1.0.2 until that recipe has a release on the new line.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix: merge request !18
• ❌ Testing to ensure no regression
• ➖ Automated unit testing coverage
• ➖ Automated functional testing coverage
• ➖ UX/UI designer responsibilities
• ➖ Readability
• ➖ Accessibility
• ➖ Performance
• ➖ Security
• ➖ Developer Documentation
• ➖ User Guide Documentation
• ❌ Reviewed by human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Release notes snippet
• ✅ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Varbase AI now requires drupal/ai ~1.5.2, so it installs again with Composer 2.9 and later.