Merge pull request #88 from wp-cli/remove-roave-security-advisories

Remove roave/security-advisories and require Composer 2.9

Author: schlessera

.readme-partials/INSTALLATION.md

@@ -6,7 +6,9 @@ In order to make code changes to WP-CLI, you'll need to set up this `wp-cli-dev`
 2. Install all Composer dependencies for a complete `wp-cli-bundle` setup, while symlinking all of the previously cloned packages into the Composer `vendor` folder.
 3. Symlink all folder in `vendor` into corresponding `vendor` folders in each repository, thus making the centralized functionality based on Composer available in each repository subfolder.
 
-Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/), PHP, and a functioning MySQL or MariaDB server on your local machine.
+Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/) 2.9 or later, PHP, and a functioning MySQL or MariaDB server on your local machine.
+
+Composer 2.9 and later refuse to install package versions with known security advisories, which protects the development environment from vulnerable dependencies. That is why WP-CLI doesn't rely on the `roave/security-advisories` package for this anymore. Older Composer versions install without this check. See the [Composer 2.9 release post](https://blog.packagist.com/composer-2-9/) for details.
 
 Once the prerequisites are met, clone the GitHub repository and run the installation process:
 

composer.json

@@ -256,9 +256,6 @@
         "wp-cli/wp-config-transformer": "dev-main as 1.2.x-dev",
         "wp-cli/wp-super-cache-cli": "dev-main"
     },
-    "require-dev": {
-        "roave/security-advisories": "dev-latest"
-    },
     "suggest": {
         "psy/psysh": "Enhanced `wp shell` functionality"
     },