From 290d38de7f85690bb02995d29e8b27bd8c8c11b4 Mon Sep 17 00:00:00 2001
From: W0rma <beck.worma@gmail.com>
Date: Tue, 3 Nov 2026 13:08:23 +0100
Subject: [PATCH] Don't block installs on security advisories

Dependencies in this repository are only used locally to build the
docs and are never deployed, so advisories are reported instead of
blocking composer update. Malware blocking keeps its default.
---
 composer.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/composer.json b/composer.json
index 3dce5c21e..c25f88fe8 100644
--- a/composer.json
+++ b/composer.json
@@ -43,6 +43,12 @@
       "ext-mongodb": "1.21.2",
       "ext-phalcon": "4.1.1"
     },
+    "policy": {
+      "advisories": {
+        "block": false,
+        "audit": "report"
+      }
+    },
     "allow-plugins": {
       "php-http/discovery": true
     }