[Jonas Elfering (keulinho)]

1. Why is this change necessary?

Composer 2.9 refuses to resolve older Shopware versions that require dompdf/dompdf below 3.1.6 because six recently published CVEs block dependency resolution. This prevents the web installer from running composer install or composer update for those versions.

2. What does this change do, exactly?

• Adds the six Dompdf CVE identifiers to the generated project composer.json before install or update.
• Limits each exception to dependency blocking, so composer audit continues to report the advisories.
• Links every exception to its GitHub advisory and documents that Shopware is not affected because only authenticated administration users can manipulate input rendered by Dompdf.
• Preserves existing project advisory ignores, including list-form configurations.

3. Describe each step to reproduce the issue or behaviour.

1. Resolve a project requiring dompdf/dompdf:3.1.4 with Composer 2.9.5.
2. Without this change, Composer rejects the version because of the six security advisories.
3. Run the project Composer JSON updater and resolve dependencies again.
4. Composer now resolves the dependencies and still reports all six findings for auditing.

Verified with:

• PHPUnit: 98 tests, 290 assertions
• PHPStan
• PHP CS Fixer
• A Composer 2.9.5 dry-run resolving dompdf/dompdf:3.1.4

4. Please link to the relevant issues (if any).

None.

5. Checklist

• I have written tests and verified that they fail without my change
• I have updated developer-facing release notes if this change is relevant for external developers
• I have written or adjusted the documentation and agent skills according to my changes
• This change has comments for package types, values, functions, and non-obvious lines of code
• I have read the contribution requirements and fulfilled them