Download the PHP package lightswitch05/php-version-audit without Composer

On this page you can find all versions of the php package lightswitch05/php-version-audit. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package php-version-audit

PHP Version Audit

PHP Version Audit Logo

Github Stars GitHub Workflow Status Packagist Version Docker Pulls license last commit commit activity

PHP Version Audit is a convenience tool to easily check a given PHP version against a regularly updated list of CVE exploits, new releases, and end of life dates.

PHP Version Audit is not: exploit detection/mitigation, vendor-specific version tracking, a replacement for staying informed on PHP releases and security exploits.

  • Features
  • Example
  • Usage
    • Docker
    • CLI
    • Direct Invocation
    • JSON Rules
    • Options
  • Output
  • Project Goals
  • Acknowledgments & License

Features:

Example:

docker run --rm -t lightswitch05/php-version-audit:latest --version=8.0.12
{
    "auditVersion": "8.0.12",
    "hasVulnerabilities": true,
    "hasSecuritySupport": true,
    "hasActiveSupport": true,
    "isLatestPatchVersion": false,
    "isLatestMinorVersion": false,
    "isLatestVersion": false,
    "latestPatchVersion": "8.0.14",
    "latestMinorVersion": "8.1.1",
    "latestVersion": "8.1.1",
    "activeSupportEndDate": "2022-11-26T00:00:00+0000",
    "securitySupportEndDate": "2023-11-26T00:00:00+0000",
    "rulesLastUpdatedDate": "2022-01-18T02:13:52+0000",
    "vulnerabilities": {
        "CVE-2021-21707": {
            "id": "CVE-2021-21707",
            "baseScore": 5.3,
            "publishedDate": "2021-11-29T07:15:00+0000",
            "lastModifiedDate": "2022-01-04T16:12:00+0000",
            "description": "In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended."
        }
    }
}

Usage

Docker

Running with docker is the preferred and easiest way to use PHP Version Audit.

Check a specific version of PHP using Docker:

docker run --rm -t lightswitch05/php-version-audit:latest --version=8.1.1

Check the host's PHP version using Docker:

docker run --rm -t lightswitch05/php-version-audit:latest --version=$(php -r 'echo phpversion();')

Run behind an HTTPS proxy (for use on restricted networks). Requires a volume mount of a directory with your trusted cert (with .crt extension) - see update-ca-certificates for more details.

docker run --rm -t -e https_proxy='https://your.proxy.server:port/' --volume /full/path/to/trusted/certs/directory:/usr/local/share/ca-certificates lightswitch05/php-version-audit:latest --version=8.1.1

CLI

Not using docker? Not a problem. It is a couple more steps, but it is just as easy to run directly.

Install the package via composer:

composer require lightswitch05/php-version-audit:~1.0

Execute the PHP script, checking the run-time version of PHP:

./vendor/bin/php-version-audit

Produce an exit code if any CVEs are found:

./vendor/bin/php-version-audit --fail-security

Direct Invocation

Want to integrate with PHP Version Audit? That's certainly possible. A word caution, this is a very early release. I do not have any plans for breaking changes, but I'm also not committed to keeping the interface as-is if there are new features to implement. Docker/CLI is certainly the preferred method over direct invocation.

$phpVersionAudit = new lightswitch05\PhpVersionAudit\Application(phpversion(), false);
$phpVersionAudit->hasVulnerabilities(); #=> true
$phpVersionAudit->getLatestPatchVersion(); #=> '8.1.1'

JSON Rules

The data used to drive PHP Version Audit is automatically updated on a regular basis and is hosted on GitHub pages. This is the real meat-and-potatoes of PHP Version Audit, and you can consume it directly for use in other tools. If you choose to do this, please respect the project license by giving proper attribution notices. Also, I ask any implementations to read the lastUpdatedDate and fail if it has become out of date (2+ weeks). This should not happen since it is automatically updated... but we all know how fragile software is.

Get the latest PHP 8.1 release version directly from the rules using curl and jq:

curl -s https://www.github.developerdan.com/php-version-audit/rules-v1.json | jq '.latestVersions["8.1"]'

Options

usage: php-version-audit        [--help] [--version=PHP_VERSION]
                                [--fail-security] [--fail-support]
                                [--fail-patch] [--fail-latest]
                                [--no-update] [--silent]
                                [--v]

optional arguments:
--help                          show this help message and exit.
--version                       set the PHP Version to run against. Defaults to the runtime version. This is required when running with docker.
--fail-security                 generate a 10 exit code if any CVEs are found, or security support has ended.
--fail-support                  generate a 20 exit code if the version of PHP no longer gets active (bug) support.
--fail-patch                    generate a 30 exit code if there is a newer patch-level release.
--fail-latest                   generate a 40 exit code if there is a newer release.
--no-update                     do not download the latest rules. NOT RECOMMENDED!
--silent                        do not write any error messages to STDERR.
--v                             Set verbosity. v=warnings, vv=info, vvv=debug. Default is error. All logging writes to STDERR.

Output

Project Goals:

Acknowledgments & License

All versions of php-version-audit with dependencies

PHP Build Version
Package Version
Requires php Version >=8.2.0
ext-json Version *
ext-curl Version *
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package lightswitch05/php-version-audit contains the following files

Loading the files please wait ....