DOCSEARCHbyAlgolia
Submit Docs

Roave Security Advisories

repository·latest·Indexed 25 days ago

https://github.com/roave/securityadvisories

A Composer package that prevents the installation of PHP dependencies with known security vulnerabilities by leveraging data from the GitHub Advisory Database and FriendsOfPHP security advisories. It works by causing Composer to fail during 'composer require' or 'composer update' if a vulnerable package version is detected.

Tokens
237
Snippets
1
Records
2
Agent score
34%

What's inside roave/security-advisories

  1. Install Roave Security Advisories

    latest

    Install roave/security-advisories as a development dependency to prevent your application from installing dependencies with known security vulnerabilities. Because security issues are a moving target, this package is only available via the dev-latest version and should be installed in the root of your deployable project.

    composer require --dev roave/security-advisories:dev-latest

  2. Use Roave Security Advisories to prevent vulnerable dependencies

    latest

    The package has no API or classes; it works by making Composer fail if you attempt to install a package version with a known security vulnerability.

    Security checks are triggered during:

    1. composer require (when adding a new dependency)
    2. composer update

    Note that composer install using an existing composer.lock file will NOT trigger security checks. To manually trigger a check without modifying your files, use the --dry-run flag with composer update.