GAE now runs composer itself and dev dependencies are not installed https://cloud.google.com/appengine/docs/standard/php7/specifying-dependencies
the zend security model runs libxml_disable_entity_loader to disable it so it's fine to allow