>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3564269. --> Reported by: [jonathan1055](https://www.drupal.org/user/92645) Related to !442 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The <a href="https://git.drupalcode.org/project/gitlab_templates_downstream/-/jobs/7737555#L412">Composer (previous major) job in the d9-basic branch</a> has just started to fail with security blocks in Drupal 9.5</p> <pre>Problem 1<br>&nbsp;&nbsp;&nbsp; - Root composer.json requires drupal/core-recommended ^9.5 -&gt; satisfiable by drupal/core-recommended[9.5.x-dev].<br>&nbsp;&nbsp;&nbsp; - drupal/core-recommended 9.5.x-dev requires twig/twig ~v2.15.4 -&gt; found twig/twig[v2.15.4, v2.15.5, v2.15.6] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-yhcn-xrg3-68b1", "PKSA-2wrf-1xmk-1pky", "PKSA-6319-ffpf-gx66") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.</pre><p>This must be a relatively new discovery, because the scheduled pipeline on 17th December was OK<br> <a href="https://git.drupalcode.org/project/gitlab_templates_downstream/-/pipelines?page=1&amp;scope=all&amp;source=schedule&amp;ref=d9-basic">https://git.drupalcode.org/project/gitlab_templates_downstream/-/pipelines?page=1&amp;scope=all&amp;source=schedule&amp;ref=d9-basic</a></p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <h3 id="summary-remaining-tasks">Remaining tasks</h3> > Related issue: [Issue #3546616](https://www.drupal.org/node/3546616)