- This step can be done earlier, but can't be merged until the security review is complete.
Why not if the library is optionally used if present?
- In your extension's entry point, add code to load the composer autoloader if it has been created
This is only for third party users right? Since WMF uses mediawiki/vendor. What is the recommended way to do this with extension registration?
- The first one is specifically about MediaWiki core, enough people blindly run "composer update", and we shouldn't have them install libraries without making sure they've passed a security review...
- Yes, the extension distributor just runs "composer install" when generating the tarball since it can't add it via the merge plugin. In extension registration, you can use callbacks. See SyntaxHighlight GeSHi for an example. Legoktm (talk) 18:37, 17 August 2015 (UTC)
I could not understand this at all. I think it would really help if it was expounded upon.