In the Shopware ecosystem, there is the a security plugin which can be installed / updated via Composer to fix known vulnerabilities if an update of the core packages would be to risky or time consuming at that moment.

So what happens is, that we update the security plugin but composer update would still complain about the shopware/core CVEs, even they are patched by the plugin.

An idea would be that a composer package can provide a audit.fixes list so that CVEs in the core packages are automatically ignored. Currently it's necessary to do this manually in the root composer.json

Other options:

Of course this itself is some workaround already and I guess the plugin is meant mostly for stores which are not really fully composer managed and merchants update via the admin panel.
Shopware also could release patched core packages for each minor version, so there would be no need for the security plugin.

I am fully okay with a "won't implement" response, but wanted to bring this discussion on the table.