Repolode
Submit
Roave

Roave/SecurityAdvisories

A Composer dev dependency that blocks installing PHP packages with known security advisories, updated daily.

View on GitHub
Stars
2,929
Forks
111
Open issues
1
Last commit
21 hours ago

What is it?

Roave/SecurityAdvisories is a Composer package that prevents your PHP project from installing dependencies with known security vulnerabilities. It contains no runtime code; instead it declares conflicts against vulnerable package versions, so Composer refuses to resolve them during dependency changes.

Add it to the require-dev section of your composer.json and any attempt to require or update to an affected version fails. The conflict list is built from the FriendsOfPHP security advisories database and the GitHub Advisory Database, and is refreshed hourly by an automated build.

The checks run only when adding a dependency with composer require or running composer update. Installing from an existing composer.lock does not trigger them, and the package must be installed as dev-latest, since it has no stable tagged releases.

Key features

  • 01Declares conflicts against known vulnerable Composer package versions
  • 02Refreshed hourly from FriendsOfPHP and GitHub Advisory Database data
  • 03Blocks risky installs and updates during composer require and composer update
  • 04Requires no code changes or API usage in your application

Use cases

  • Guarding a PHP application against accidentally adding a vulnerable library
  • Preventing dependency updates from pulling in versions with published security issues
  • Adding a basic supply-chain check to a team's Composer workflow

Quick start

  1. 1

    Install it as a dev dependency with Composer

    composer require --dev roave/security-advisories:dev-latest

Things to know

  • Only the dev-latest version exists, with no stable tagged releases.
  • It provides no API or classes; it only blocks installing packages with known advisories.
  • Checks run only on composer require or composer update, not on composer install.

In collections

Security scanners, audits & threat intel tools

Topics

#php#composer#security#vulnerability-scanning#supply-chain-security#dependencies#infosec#security-advisories#security-vulnerabilities#security-vulnerability

FAQ

What is SecurityAdvisories?
A Composer dev dependency that blocks installing PHP packages with known security advisories, updated daily. Roave/SecurityAdvisories is a Composer package that prevents your PHP project from installing dependencies with known security vulnerabilities. It contains no runtime code; instead it declares conflicts against vulnerable package versions, so Composer refuses to resolve them during dependency changes.
Is SecurityAdvisories free to use? What license does it have?
SecurityAdvisories is open source under the MIT license. Check the license terms before using it in commercial products.
Is SecurityAdvisories still maintained?
Actively maintained. The last commit to SecurityAdvisories was on Nov 7, 2026.
What can I use SecurityAdvisories for?
Guarding a PHP application against accidentally adding a vulnerable library Preventing dependency updates from pulling in versions with published security issues Adding a basic supply-chain check to a team's Composer workflow
How do I install SecurityAdvisories?
Install it as a dev dependency with Composer: composer require --dev roave/security-advisories:dev-latest
Where can I get SecurityAdvisories?
The source code and installation instructions are on GitHub: https://github.com/Roave/SecurityAdvisories

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects