[REF] Upgrade DomPDF to v0.8.6

[seamuslee001]

Overview

Upgrades DomPDF version to v0.8.6

Before

DomPDF Version 0.8.5 used

After

DomPDF version 0.8.6 used

Technical Details

Fixes a minor security issue and also fixes a few other issues https://github.com/dompdf/dompdf/releases/tag/v0.8.6

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[eileenmcnaughton]

@seamuslee001 given we have just cut the rc I'm OK merging this - since we do generally try to keep this up to date - any thoughts?

[seamuslee001]

I had tested this on a firefox page and worked so lets merge it tbqh

[eileenmcnaughton]

@seamuslee001 ok - I'm fine with merging if you fix up the PR template - we should link to the changelog changes in that

[seamuslee001]

Updated now @eileenmcnaughton

[eileenmcnaughton]

Cool - just noting this requires php7.1 so any ESR backport is out

[eileenmcnaughton]

This might require some action?

Note on resource references: Because of the changes in resource security, some resources (images, external stylesheets) that would previously load with the default settings may not longer load. To ensure compatibility with this release ensure the remote resources can be loaded and that any local filesystem resources are within the directory specified by the chroot setting. By default, chroot is set to the Dompdf directory. Information on how to change these settings can be found in the readme section on setting options.

This update addresses the following announced vulnerabilities:

[colemanw]

@seamuslee001 I don't really understand how Composer works, but why is the "content-hash" not getting updated at the top of the file in this PR?

[seamuslee001]

@colemanw checking this suggests that https://stackoverflow.com/questions/46185777/is-content-hash-a-mandatory-part-of-composer-lock it is only when things change in composer.json that the hash gets updated