Fixes tecnickcom/tcpdf security CVEs

[joelpittet]

Fixes the following CVE-2024-56522, CVE-2024-56527, CVE-2024-56519, CVE-2024-56521

❯ composer audit
Found 4 security vulnerability advisories affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | tecnickcom/tcpdf                                                                 |
| Severity          | medium                                                                           |
| CVE               | CVE-2024-56522                                                                   |
| Title             | TCPDF has incorrect comparison                                                   |
| URL               | https://github.com/advisories/GHSA-w95c-7994-ghpr                                |
| Affected versions | <6.8.0                                                                           |
| Reported at       | 2024-12-27T06:30:48+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | tecnickcom/tcpdf                                                                 |
| Severity          | medium                                                                           |
| CVE               | CVE-2024-56527                                                                   |
| Title             | TCPDF missing character escape on error messages                                 |
| URL               | https://github.com/advisories/GHSA-qx95-cwh6-9mvq                                |
| Affected versions | <6.8.0                                                                           |
| Reported at       | 2024-12-27T06:30:48+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | tecnickcom/tcpdf                                                                 |
| Severity          | medium                                                                           |
| CVE               | CVE-2024-56519                                                                   |
| Title             | TCPDF lacks SVG sanitization                                                     |
| URL               | https://github.com/advisories/GHSA-4p8j-vhjm-6pvw                                |
| Affected versions | <6.8.0                                                                           |
| Reported at       | 2024-12-27T06:30:47+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | tecnickcom/tcpdf                                                                 |
| Severity          | high                                                                             |
| CVE               | CVE-2024-56521                                                                   |
| Title             | TCPDF missing certificate validation                                             |
| URL               | https://github.com/advisories/GHSA-9mgx-552f-59p6                                |
| Affected versions | <6.8.0                                                                           |
| Reported at       | 2024-12-27T06:30:47+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Minor semver updated

❯ composer update tecnickcom/tcpdf
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 1 update, 0 removals
  - Upgrading tecnickcom/tcpdf (6.7.7 => 6.8.0)

[snipe]

Damn you’re fast! I just got the snyk a few hours ago. Thanks!

[joelpittet]

@snipe Oh I can leave it to snyk if that works better for your workflow?