2017 © Pedro Peláez
 

metapackage security-advisories

Prevents installation of composer packages with known security vulnerabilities: no API, simply require it

image

roave/security-advisories

Prevents installation of composer packages with known security vulnerabilities: no API, simply require it

  • Wednesday, July 18, 2018
  • by Ocramius
  • Repository
  • 67 Watchers
  • 1113 Stars
  • 3,033,686 Installations
  • PHP
  • 712 Dependents
  • 19 Suggesters
  • 41 Forks
  • 1 Open issues
  • 1 Versions
  • 16 % Grown

The README.md

Roave Security Advisories

Hourly build Downloads, (*1)

This package ensures that your application doesn't have installed dependencies with known security vulnerabilities., (*2)

Installation

composer require --dev roave/security-advisories:dev-latest

Usage

This package does not provide any API or usable classes: its only purpose is to prevent installation of software with known and documented security issues. Simply add "roave/security-advisories": "dev-latest" to your composer.json "require-dev" section and you will not be able to harm yourself with software with known security vulnerabilities., (*3)

For example, try following:, (*4)

composer require --dev roave/security-advisories:dev-latest
# following commands will fail:
composer require symfony/symfony:2.5.2
composer require zendframework/zendframework:2.3.1 

The checks are only executed when adding a new dependency via composer require or when running composer update: deploying an application with a valid composer.lock and via composer install won't trigger any security versions checking., (*5)

You can manually trigger a version check by using the --dry-run switch on an update while not doing anything. Running composer update --dry-run roave/security-advisories is an effective way to manually trigger a security version check., (*6)

roave/security-advisories for enterprise

Available as part of the Tidelift Subscription., (*7)

The maintainers of roave/security-advisories and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more., (*8)

You can also contact us at team@roave.com for looking into security issues in your own project., (*9)

Stability

This package can only be required in its dev-latest version: there will never be stable/tagged versions because of the nature of the problem being targeted. Security issues are in fact a moving target, and locking your project to a specific tagged version of the package would not make any sense., (*10)

This package is therefore only suited for installation in the root of your deployable project., (*11)

Sources

This package extracts information about existing security issues in various composer projects from the FriendsOfPHP/security-advisories repository., (*12)

The Versions

18/07 2018

dev-master

9999999-dev

Prevents installation of composer packages with known security vulnerabilities: no API, simply require it

  Sources   Download

MIT