chore: refresh composer.lock to Shopware 6.7.14.0, clearing 126 alerts [DEVOPS-73]

[ZukalJakub]

Clears all 126 open Dependabot alerts on this repo (10 critical, 34 high, 59 medium, 23 low) — every one of them from a single file, composer.lock, frozen at shopware/core 6.4.9.0 since 2022.

Re-resolved against the repo's actual constraint, shopware/core: "6.*":

105 upgrades, 54 new, 38 removals
shopware/core 6.4.9.0 => v6.7.14.0
146 => 162 locked packages

composer audit --locked: 128 advisories affecting 25 packages → 0.

What this does and does not change

Please read this before treating it as a security fix.

This repo declares exactly one dependency:

"require": { "shopware/core": "6.*" }

It is a shopware-platform-plugin — it ships as SmartsuppLiveChat.zip into a merchant's own Shopware installation and carries no vendor/ directory. Everything in the lock is Shopware's own framework tree (aws/aws-sdk-php, composer/composer, the Symfony stack), which the merchant's shop resolves independently at whatever version they run.

So this refresh clears the alert count. It does not change what any merchant executes. Worth knowing, since committing the lock also implicitly asserts a Shopware version we've now moved from 6.4 to 6.7.

Verification

Run in a Docker sandbox on php:8.2-cli-alpine:

check	result
composer validate	valid (only the pre-existing "version field is present" warning)
composer audit --locked	no advisories (was 128)
composer install from the new lock	exit 0 — 159 packages, 47 vendor dirs, shopware/core present
php -l across src/	no syntax errors

The install used --no-plugins (composer blocks the un-allowlisted symfony/runtime plugin) and --ignore-platform-req=ext-*, with COMPOSER_VENDOR_DIR redirected so the repo stayed clean. There is no test suite or CI in this repo to run beyond that.

Not addressed here

• Four stale dependabot/composer/* branches from 2022 are still on the remote.
• This repo has no CI, so nothing validates the lock on future changes.
• Whether a plugin written against 6.4-era APIs still loads on Shopware 6.7 is a compatibility question this PR does not answer — the lock refresh is not evidence either way.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 9a1b9b63-c2b1-41d1-baba-73d5a8ed0407

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}