Found 6 security vulnerability advisories affecting 2 packages

[OZ1SEJ]

I don't have a lot of experience with composer, but when I add php-qrcode, I get

$ composer require chillerlan/php-qrcode
[lots of stuff]
Found 6 security vulnerability advisories affecting 2 packages.
$ composer audit
Found 6 security vulnerability advisories affecting 2 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | guzzlehttp/psr7                                                                  |
| Severity          | medium                                                                           |
| CVE               | CVE-2023-29197                                                                   |
| Title             | Improper header validation                                                       |
| URL               | https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw           |
| Affected versions | >=2,<2.4.5|<1.9.1                                                                |
| Reported at       | 2023-04-17T16:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2023-52892                                                                   |
| Title             | Name confusion in x509 Subject Alternative Name fields                           |
| URL               | https://github.com/advisories/GHSA-ff7q-6vwh-v9m4                                |
| Affected versions | >=3.0.0,<3.0.33|>=2.0.0,<2.0.46|<1.0.22                                          |
| Reported at       | 2024-06-28T00:33:31+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2024-27354                                                                   |
| Title             | phpseclib a large prime can cause a denial of service                            |
| URL               | https://github.com/advisories/GHSA-hg35-mp25-qf6h                                |
| Affected versions | >=3.0.0,<3.0.36|>=2.0.0,<2.0.47|>=1.0.0,<1.0.23                                  |
| Reported at       | 2024-03-02T00:31:33+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2024-27355                                                                   |
| Title             | phpseclib does not properly limit the ASN1 OID length                            |
| URL               | https://github.com/advisories/GHSA-jr22-8qgm-4q87                                |
| Affected versions | >=3.0.0,<3.0.36|>=2.0.0,<2.0.47|>=1.0.0,<1.0.23                                  |
| Reported at       | 2024-03-02T00:31:33+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2023-49316                                                                   |
| Title             | phpseclib vulnerable to denial of service                                        |
| URL               | https://github.com/advisories/GHSA-jpr7-q523-hx25                                |
| Affected versions | >=3.0.0,<3.0.34                                                                  |
| Reported at       | 2023-11-27T18:31:14+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2023-27560                                                                   |
| Title             | Infinite Loop vulnerability                                                      |
| URL               | https://github.com/advisories/GHSA-hm7p-r324-hhf3                                |
| Affected versions | >=3.0.0,<3.0.19                                                                  |
| Reported at       | 2023-03-06T09:20:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Is this something I can resolve, or will I just need to accept it?

[codemasher]

These are dependencies of dev-dependencies, none of these issues affect this library.