Composer / PHP

Planned

Planned — not available yet. No Composer / PHP parser exists today. This page describes the intended design, and details may change before anything ships.

Turn composer.lock files into a dependency inventory you can compare.

Composer / PHP is not a connector to an outside account. It is a planned parser and normalizer: it reads composer.json and composer.lock files — from the GitHub connector, from a WordPress site's report, or from a file you provide — and turns them into one inventory of packages, versions and PHP platform requirements.

Email us about Composer / PHP All planned connectors

Planned capabilities

Package and exact locked version per project
PHP version and extension requirements declared by each project
Package names and versions normalized so projects can be compared
Evidence records prepared for a separate security assessment

How it will work

Files are parsed as data. The parser is not intended to run Composer, install packages or execute any code from the project. Each result records where the file came from, so evidence from a repository and evidence uploaded by hand stay distinguishable.

Security and permissions

The parser needs no credentials of its own. It inherits the access of whichever source supplied the file, such as a read-only GitHub installation. Private package repository credentials in auth.json are out of scope and are never requested.

Use cases

PHP dependency inventory

A team sees every project that locks a given package, and at which version.

Platform requirements

Projects that still declare an old PHP requirement are listed before a runtime upgrade.

Evidence preparation

Normalized package versions are handed to a separate assessment service rather than evaluated here.

Questions

Is the Composer parser available today?: No. It is planned, and no files can be submitted yet.
Is Composer a connector?: Not in the usual sense. It does not connect to an account. It reads files that another connector, or you, provide.
Will it run composer install?: No. The planned design parses the files as data and never executes project code.

Interested in Composer / PHP?

Connector order follows what customers actually run. Tell us what you would connect and how many sites, accounts or repositories are involved.

Email us