Composer 2.4 features scanning the installed and new packages for known security vulnerabilities. When a new package is installed, or an existing package is updated, Composer looks up the package version numbers on known security vulnerability announcements, and reports if there are any known vulnerabilities in the list of packages. There is also a new command called audit, that lists reported security vulnerabilities on current package versions.

Automatic warnings when installing/updating packages

Since Composer 2.4, updating or installing a package automatically scans the list of installed packages for any reported security vulnerabilities using the Packagist.org Security Vulnerability API. If it encounters any vulnerable version, Composer shows warning:

Composer showing a warning on `composer update` command if there are known vulnerabilities in the list of installed packages

It is possible to show the list of reported vulnerabilities along the output of composer update and composer install commands with the new --audit-format flag. The supported values are the same as the ones supported by the composer audit command.

This security audit can be disabled with the new --no-audit flag.

composer audit command

Since Composer 2.4, there is a new command called audit, that outputs a list of reported security vulnerabilities for the list of packages versions currently installed.

`composer audit` command output

The output of the composer audit command includes all reported security vulnerabilities that match the version and package name of the advisory's indicated version constraints.

From each advisory matched, Composer shows the package name, CVE identifier, the title of the advisory, a link to the advisory, range(s) of affected versions, and the date when the advisory was published.

By default, Composer shows the list of advisories as a table, but it also supports plain and summary outputs by specifying it in the --format command line flag. By default, the output format is set to --format=table.

`composer audit --format=plain` command output

`composer audit --format=summary` command output

composer update and composer install commands may use --audit-format flag to specify output format. e.g composer update --audit-format=table.

Enforcing Security Audit in CI/CD Pipelines

composer audit command exits with the number of advisories that match the current list of installed packages.

CI/CD pipelines that wish to ensure there are no known vulnerabilities before proceeding the pipeline (such as deploying the application) may run composer audit command during the pipeline. If composer audit exits with a value other than zero, it means there is at least one reported security vulnerability in the list of installed packages. Unless otherwise configured, any command that exits with a non-zero status triggers a typical CI/CD pipeline to fail.

Security Vulnerability Lookup API on Packagist

packagist.org, the main source of package metadata of Composer, now has a new API that returns a list of reported security vulnerabilities for a given list of package names. Packagist routinely fetches the vulnerability information from Github Security Advisories and FriendsOfPHP/security-advisories repository.

Composer uses this API to retrieve a list of security vulnerabilities, but the API is open, and other applications may make use of this API for its own use cases too.

The JSON API endpoint is https://packagist.org/api/security-advisories/. It supports two parameters:

• packages: Required. A list of package names to lookup advisories for.
• updatedSince: Optional. Specify a Unix timestamp to filter advisories. Only advisories updated after this timestamp will be returned.

Here is a working URL that returns security advisories for guzzlehttp/guzzlehttp package:

https://packagist.org/api/security-advisories/?packages[]=guzzlehttp/guzzle

Blocking Installation of Vulnerable Packages

composer audit command only audits the packages after they are installed. Roave/SecurityAdvisories is a Composer meta-package (which means it has no PHP functionality) that blocks any reportedly vulnerable package from being installed in the first place.

Composer Security Hardening
Block packages with known vulnerabilities