Installing older Shopware versions: handling the DomPDF security advisories
Shopware releases prior to 6.7.12.2 and 6.6.10.21 require a version of DomPDF that has published security advisories. Composer blocks package versions with known advisories, so these Shopware versions can no longer be installed without an additional step.
If you are setting up a new project on the current version, this does not affect you. The advisories are resolved in 6.7.12.2 and 6.6.10.21, and we recommend using the latest version for new installations anyway. The information below is only relevant if you deliberately need an older release, for reproducing an issue against a specific version, for example.
To install an affected version, you need to tell Composer explicitly to ignore the advisory.
Using Shopware CLI
The current version of Shopware CLI detects this and prompts you to ignore the advisory during project creation. On older versions, skip the audit manually:
shopware-cli project create --no-audit my-project
Using other installation methods
Add the relevant advisory IDs to your composer.json:
json
{
"config": {
"audit": {
"ignore": {
"CVE-XXXX-XXXXX": "Only relevant for older Shopware versions, accepted for testing"
}
}
}
}
Before you ignore anything
As always when suppressing a security advisory: know what you are suppressing and whether it affects your setup. In this case, DomPDF is only accessible for authenticated admin users, which generally makes it a low-risk scenario. You can review all published advisories for DomPDF 3.1.4 on Packagist:
https://packagist.org/packages/dompdf/dompdf/advisories?version=9465787
