`dev/2.0` branch fails to install vendor libraries due to `phpoffice/phpspreadsheet[1.29.8]...affected by security advisories.`

[0nobody0]

while testing the dev/2.0 branch of pawtucket2 vendor library installs failed with:

  Problem 1
    - Root composer.json requires phpoffice/phpspreadsheet v1.29.8 (exact version match), found phpoffice/phpspreadsheet[1.29.8] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-64jn-3d9t-gncx", "PKSA-8b16-mcgz-h4cz") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 2
    - Root composer.json requires phpoffice/phppresentation 1.0.0 -> satisfiable by phpoffice/phppresentation[1.0.0].
    - phpoffice/phppresentation 1.0.0 requires phpoffice/phpspreadsheet ^1.9.0 -> found phpoffice/phpspreadsheet[1.9.0, ..., 1.30.1] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-64jn-3d9t-gncx", "PKSA-8b16-mcgz-h4cz") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

following the instructions to add the advisory ids to the audit ignore config in composer.json seems to be a temporary workaround since i wasn't sure if bumping the library version would cause issues:

  "config": {
    "discard-changes": true,
    "allow-plugins" : {
      "php-http/discovery": false,
      "simplesamlphp/composer-module-installer": true,
      "oat-sa/composer-npm-bridge": true
    },
   "audit": {
      "ignore": [
        "PKSA-64jn-3d9t-gncx",
        "PKSA-8b16-mcgz-h4cz"
      ]
    }
  }

[collectiveaccess]

The Pawtucket composer.json needs changes along the lines of what was done on the Providence side.

[goetzk]

Will the other code related changes be needed too or can composer.json be changed in isolation?
collectiveaccess/providence@f0b327d