For additional security you should declare the allow-plugins config with a list of packages names that are allowed to run code. See https://getcomposer.org/allow-plugins
You have until July 2022 to add the setting. Composer will then switch the default behavior to disallow all plugins.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 1 update, 0 removals
 - Upgrading phpmailer/phpmailer (v6.5.3 => v6.5.4)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 1 update, 0 removals
 - Downloading phpmailer/phpmailer (v6.5.4)
 - Upgrading phpmailer/phpmailer (v6.5.3 => v6.5.4): Extracting archive
Package phpunit/php-token-stream is abandoned, you should avoid using it. No replacement was suggested.
Generating autoload files
32 packages you are using are looking for funding.
Use the `composer fund` command to find out more!