New composer audit Command and security audits in Composer 2.4

Published On2022-06-26

New `composer audit` command in Composer 2.4

Composer 2.4 features scanning the installed and new packages for known security vulnerabilities. When a new package is installed, or an existing package is updated, Composer looks up the package version numbers on known security vulnerability announcements, and reports if there are any known vulnerabilities in the list of packages. There is also a new command called audit, that lists reported security vulnerabilities on current package versions.

Automatic warnings when installing/updating packages

Since Composer 2.4, updating or installing a has an option to scan the list of installed packages for any reported security vulnerabilities using the Packagist.org Security Vulnerability API.

composer require and composer update commands support a new --audit flag that scans the list of packages, and if it encounters any vulnerable version, Composer shows warning:

Composer showing a warning on `composer update` command if there are known vulnerabilities in the list of installed packages
Composer showing a warning on `composer update` command if there are known vulnerabilities in the list of installed packages

It is possible to show the list of reported vulnerabilities along the output of composer update and composer install commands with the new --audit-format flag. The supported values are the same as the ones supported by the composer audit command.

This security audit can be disabled with the new --no-audit flag.

composer audit command

Since Composer 2.4, there is a new command called audit, that outputs a list of reported security vulnerabilities for the list of packages versions currently installed.

Composer `audit` command output
`composer audit` command output

The output of the composer audit command includes all reported security vulnerabilities that match the version and package name of the advisory's indicated version constraints.

From each advisory matched, Composer shows the package name, CVE identifier, the title of the advisory, a link to the advisory, range(s) of affected versions, and the date when the advisory was published.

By default, Composer shows the list of advisories as a table, but it also supports plain, json and summary outputs by specifying it in the --format command line flag. By default, the output format is set to --format=table.

Composer `audit` command output as a plain list
`composer audit --format=plain` command output

Composer `audit` command output as a summary
`composer audit --format=summary` command output

Composer `audit` command output as a JSON object
`composer audit --format=json` command output

composer update and composer install commands may use --audit-format flag to specify output format. e.g composer update --audit-format=table.

Enforcing Security Audit in CI/CD Pipelines

composer audit command exits with the number of advisories that match the current list of installed packages.

CI/CD pipelines that wish to ensure there are no known vulnerabilities before proceeding the pipeline (such as deploying the application) may run composer audit command during the pipeline. If composer audit exits with a value other than zero, it means there is at least one reported security vulnerability in the list of installed packages. Unless otherwise configured, any command that exits with a non-zero status triggers a typical CI/CD pipeline to fail.

Security Vulnerability Lookup API on Packagist

packagist.org, the main source of package metadata of Composer, now has a new API that returns a list of reported security vulnerabilities for a given list of package names. Packagist routinely fetches the vulnerability information from Github Security Advisories and FriendsOfPHP/security-advisories repository.

Composer uses this API to retrieve a list of security vulnerabilities, but the API is open, and other applications may make use of this API for its own use cases too.

The JSON API endpoint is https://packagist.org/api/security-advisories/. It supports two parameters:

  • packages: Required. A list of package names to lookup advisories for.
  • updatedSince: Optional. Specify a Unix timestamp to filter advisories. Only advisories updated after this timestamp will be returned.

Here is a working URL that returns security advisories for guzzlehttp/guzzlehttp package:

https://packagist.org/api/security-advisories/?packages[]=guzzlehttp/guzzle

Blocking Installation of Vulnerable Packages

composer audit command only audits the packages after they are installed. Roave/SecurityAdvisories is a Composer meta-package (which means it has no PHP functionality) that blocks any reportedly vulnerable package from being installed in the first place.

Composer Security Hardening
Block packages with known vulnerabilities

Recent Articles on PHP.Watch

All ArticlesFeed 
What's New in Composer 2.4

What's New in Composer 2.4

Composer 2.4 brings new `bump` and `audit` commands, shell completion support for commands and package names, automatic suggestions to install packages as `--dev` where appropriate, and several more new features and improvements.
Serverless PHP Applications on Digital Ocean Functions

Serverless PHP Applications on Digital Ocean Functions

How to run PHP applications on Digital Oceans Functions.
New `composer bump` Command in Composer 2.4

New `composer bump` Command in Composer 2.4

`composer bump` is a new command introduced in Composer 2.4 that updates the dependency versions listed in `composer.json` file to the current installed versions, making them the new minimum required version.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.