如何在“php bin / console security：check”之后更新

Question

Symfony write on how to check for security updates: https://symfony.com/doc/current/security/security_checker.html and it works, in Akeneo it shows me one vulnerability. But how to update? I tried ../composer.phar update and ../composer.phar update symfony/symfony but unfortunately the vulnerability is still there when I check again. (https://github.com/akeneo/pim-community-dev/issues/7146)

/var/www/html/akeneo/pim-community-standard# ../composer.phar why dompdf/dompdf:0.6.1
Do not run Composer as root/super user! See https://getcomposer.org/root for details
akeneo/pim-community-dev  v2.0.6  requires  dompdf/dompdf (0.6.1)


/var/www/html/akeneo/pim-community-standard# ../composer.phar why-not dompdf/dompdf:0.6.2
Do not run Composer as root/super user! See https://getcomposer.org/root for details
akeneo/pim-community-dev  v2.0.6  requires  dompdf/dompdf (0.6.1)  

Answer 1

The security check complains about the package dompdf/dompdf being outdated. So you have to find out which dependency is responsible for this package being installed. You can use composer for this:

composer why dompdf/dompdf

Once you find out why it's installed you can either check if you can update that dependency to a version supporting/requiring a newer dompdf version or if you installed it by requiring it yourself just update it.

Alternatively you can also ask composer why it won't install a new version by using:

composer why-not dompdf/dompdf "^0.8"

If you can't update whatever dependency depends on the outdated dompdf version you might have to resort to either create a PR in that project for a newer version or forking the project and updating the composer.json yourself (not recommended though, because of the additional work of keeping it up to date).

edit: It looks like akeneo itself is responsible for pinning the version as you can see in the repo: https://github.com/akeneo/pim-community-dev/blob/2.0/composer.json#L41

Maybe you can create a PR updating the composer.json and maybe loosening the version restriction for dompdf.