fix: #3638362 Require a drupal/ai release without open security advisories

Rajab Natshahrequested to merge
issue/varbase_ai-3638362:3638362-varbase-ai-2.0.14 into 2.0.x

Varbase AI requires drupal/ai: ~1.2.0, which Composer 2.9+ refuses because every 1.2.x release is covered by a security advisory. This moves it to ^1.5.2, a caret constraint as Drupal CMS uses for drupal/ai, and adds a CHANGELOG line.

drupal/ai 1.5 regroups the links on /admin/config/ai, so the admin pages scenario now looks for "Default Models for AI Operations" and "AI Platform Providers".

Issue: https://www.drupal.org/i/3638362

A Composer 2.11.2 dry run of the full Varbase 10.1.x stack resolves with advisory blocking on: drupal/ai 1.5.2, AI Agents 1.3.5, AI Integration - ECA 1.0.1. The MR pipeline is green, e2e included, with drupal/ai 1.5.2.

Remaining tasks

  • Varbase AI Agents 1.0.4+ still pins drupal/ai: ~1.2.0, so Composer picks Varbase AI Agents 1.0.2 until it gets a release on the new line.

AI-Generated: Yes

Checkpoints:

  • File an issue
  • Addition/Change/Update/Fix
  • Testing to ensure no regression
  • Automated unit testing coverage
  • Automated functional testing coverage
  • UX/UI designer responsibilities
  • Readability
  • Accessibility
  • Performance
  • Security
  • Developer Documentation
  • User Guide Documentation
  • Reviewed by human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Release notes snippet
  • Release

🤖 Generated with Claude Code

Edited by Rajab Natshah

Merge request reports