Guides › composer.lock Vulnerability Check: Find Known Security Advisories in PHP Dependencies

composer.lock Vulnerability Check: Find Known Security Advisories in PHP Dependencies

Most PHP sites run far more third-party code than their own. Your composer.lock pins the exact version of every package, which makes it the right input for a vulnerability check.

Option 1: composer audit (local)

composer audit            # uses composer.lock in the current folder
composer audit --locked   # audit the lock file without an installed vendor/
composer audit --format=json

Option 2: query advisory databases yourself

The OSV database (api.osv.dev) indexes advisories for the Packagist ecosystem and accepts batch queries with package name + version. The FriendsOfPHP security-advisories repository is a public, community-maintained YAML database of PHP package advisories.

Reading the results

• Note the affected version range and the first fixed version.
• Run composer update vendor/package --with-dependencies to move to a fixed release, then re-run your tests.
• If no fix exists, check the advisory for workarounds or consider replacing the package.

Don’t forget the PHP runtime

composer.lock may declare a platform PHP version. That tells you the minimum supported branch, not whether your server’s PHP is patched — see checking PHP patches on Ubuntu.

PHPSafeCheck reads composer.lock from your upload, checks every package against OSV and FriendsOfPHP, and combines it with a static code scan.

FAQ

Draft guide. Commands are standard Debian/Ubuntu/Composer tooling; always confirm against the official tracker pages linked above.