Common · PHP and Node
Vulnerable Composer and npm packages
Your code includes many packages you didn’t write. A flaw in one of them is a flaw in your site, and it won’t show up unless you check.
Why it matters to you
Laravel, Symfony and Node apps pull in dozens or hundreds of packages. Flaws in them are published all the time, and nobody tells you when one of yours is affected.
Check it yourself
- 01Run
composer auditfor PHP andnpm auditfor Node in your project. - 02Check that your lock files are committed, so you know exactly what’s deployed.
- 03Look for packages that are abandoned and no longer receive fixes.
Fix it
- 01Update the flagged packages on a copy and run your tests.
- 02Commit lock files and review dependency changes before you deploy.
- 03Remove packages you no longer use.
- 04Re-run the audits on a schedule, because new advisories keep arriving.
How PatchRig helps
PatchRig runs the audits, updates the flagged packages on a copy, tests the result, and keeps checking for new advisories.