Download the PHP package mteu/advisory-matcher without Composer
On this page you can find all versions of the php package mteu/advisory-matcher. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download mteu/advisory-matcher
More information about mteu/advisory-matcher
Files in mteu/advisory-matcher
Package advisory-matcher
Short Description PHP library for matching installed packages against security advisories from Packagist, OSV and NVD
License GPL-2.0-or-later
Homepage https://github.com/mteu/advisory-matcher
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package advisory-matcher
Framework-agnostic PHP library that matches installed packages against security advisories from Packagist, OSV, and NVD to answer on whether a package is affected by a security advisory.
You hand it packages. It gives back advisories, plus a record of which packages it actually checked and which sources failed.
[!WARNING] This project is not yet intended for production use. The API may change without notice.
🚀 Features
⚡️ Installation
You also need a PSR-18 HTTP client and PSR-17 factories. (A PSR-16 cache and a PSR-3 logger are optional.)
See framework setup for TYPO3, Symfony, and Drupal examples.
💡 Usage
To check the PHP runtime, add NvdAdvisorySource($httpClient, $factory, $nvdApiKey)
and a PackageRef(Ecosystem::Php, 'php', '8.3.6'). The API key is optional but
raises the rate limit.
📝 Things to know
- Check each package with
wasAnsweredFor().isComplete()only tells you that no source reported a failure. A package that a feed has never heard of goes unanswered without any failure, soisComplete()can be true while that package was never checked. - Matching returns affected, not affected or undetermined. Undetermined means the version couldn't be parsed or no usable range existed. It does not mean clean.
- Failures are yours to handle.
$batch->failureslists them, each with aFailureReason. The library doesn't retry. CallisTransient()to see whether asking again makes sense. - Advisory text comes from third parties. Escape every field before you show it. I mean it.
- Store findings by fingerprint, not by
advisoryId. Get it with$advisory->getFingerprint()and look it up withAdvisoryFingerprint::identitiesOf($advisory). - The library uses your HTTP client, so timeouts and proxy settings are yours to set. Each source also accepts
userAgent:andendpoint:.
📙 Documentation
See the public API reference for the supported types.
Everything else is @internal. 🤷♂️
🤝 Contributing
Contributions are very welcome! Please have a look at the Contribution Guide. It lays out the workflow of submitting new features or bugfixes.
🔒 Security
Please refer to the Security Policy if you discover a security vulnerability in this library.
⭐ License
This library is licensed under the GPL-2.0-or-later license.
💬 Support
For issues and feature requests, please use the GitHub issue tracker.
All versions of advisory-matcher with dependencies
ext-ctype Version *
ext-mbstring Version *
composer/semver Version ^3.4
psr/clock Version ^1.0
psr/http-client Version ^1.0
psr/http-factory Version ^1.1
psr/http-message Version ^2.0
psr/log Version ^2.0 || ^3.0
psr/simple-cache Version ^2.0 || ^3.0