fancyguy / composer-security-check-plugin
检查已安装的依赖项与SensioLabs安全公告数据库的匹配情况
1.2.1
2019-09-28 23:25 UTC
Requires
- composer-plugin-api: ^1.1
- ext-curl: *
- ext-json: *
- symfony/yaml: ^4.1
Requires (Dev)
- composer/composer: ^1.6
- phpunit/phpunit: ^7.2
This package is auto-updated.
Last update: 2024-08-29 04:09:17 UTC
README
全局安装
composer global require fancyguy/composer-security-check-plugin
项目安装
composer require fancyguy/composer-security-check-plugin
运行以下命令以查看一些示例行为
mkdir insecure-project
cd insecure-project
composer init --name="insecure/project" --description="insecure project" -l MIT -n
composer require symfony/symfony:2.5.2
composer require fancyguy/composer-security-check-plugin
composer audit
composer audit --format=simple
composer audit --format=json
composer validate
composer require symfony/symfony --update-with-all-dependencies
composer audit
默认情况下,此工具会将您的 composer.lock
文件上传到 security.symfony.com 互联网服务,该服务使用来自 https://github.com/FriendsOfPHP/security-advisories 的检查。
您可以通过下载此 repo 的本地版本并在其中指定路径来离线检查。
composer audit --audit-db /path/to/security-advisories