composer updates for security

[elizoller]

GitHub Issue: (link)

What does this Pull Request do?

Composer updates for security

What's new?

Composer packges

How should this be tested?

• pull in this PR
• run composer install
• make sure that Houdini still works (generate image derivatives)

Additional Notes:

supersedes #125 , #126 , #127

Interested parties

@Islandora/8-x-committers

[codecov]

Codecov Report

Merging #132 (d113e95) into 2.x (ee9ea25) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##                2.x     #132   +/-   ##
=========================================
  Coverage     77.55%   77.55%           
  Complexity      159      159           
=========================================
  Files             6        6           
  Lines           655      655           
=========================================
  Hits            508      508           
  Misses          147      147           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ee9ea25...d113e95. Read the comment docs.

[seth-shaw-unlv]

I attempted to apply this to a running isle-dc install by logging into the houdini container, updating the lock files, and then running composer install but it failed:

The following exception probably indicates you are offline or have misconfigured DNS resolver(s)

                                                                                                                   
  [Composer\Downloader\TransportException]                                                                         
  curl error 6 while downloading https://flex.symfony.com/versions.json: Could not resolve host: flex.symfony.com  

So, presumably I'd need to do this in build-kit?

Someone with a working playbook install want to give this a spin? @alxp or @whikloj?