Composer won't install packages hosted on Gerrit

Fremantle2026 October 18 (Sunday), 11:11AM· MediaWiki · Wikimedia · Git · Composer · When installing MediaWiki extensions with Composer, it can fail for extensions that are hosted on Gerrit. For example, here PluggableAuth is not able to be cloned from https://gerrit.wikimedia.org/r/mediawiki/extensions/PluggableAuth and is prompting for user credentials: $ composer update -o --no-dev Composer could not detect the root package (mediawiki/core) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version > MediaWiki\Composer\VersionChecker::onEvent Loading composer repositories with package information Updating dependencies Nothing to modify in lock file Installing dependencies from lock file Package operations: 50 installs, 6 updates, 7 removals - Syncing mediawiki/pluggable-auth (7.5.0) into cache Authentication required (gerrit.wikimedia.org): Username: Providing a username and password here won't help, because the issue is that Varnish is returning 403: $ curl -sI…