A tool for checking known vulnerabilities in a php project using composer

Question

I am working on a php project that the composer uses, but some of the dependencies are very old, including the php version. We are trying to convince the client to upgrade the php version and, therefore, all other dependencies. We would like to analyze existing dependencies and find known vulnerabilities for them.

Are there any php tools that run dependency checking ?

I did this with ruby ​​projects using batch audit , but I was not able to find a similar tool for php.

Answer 1

Well, there is the Compave Composer package from Roave ( https://github.com/Roave/SecurityAdvisories ), but the library reporting is fully consistent with the project. It checks the database from this repository: https://github.com/FriendsOfPHP/security-advisories

Many of the larger projects have their problems posted there, but since they are fairly voluntary, this may not be as widespread as you hope. Hope this helps.