Download the PHP package pixelegg/pxe-composer-report without Composer

On this page you can find all versions of the php package pixelegg/pxe-composer-report. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package pxe-composer-report

pxe_composer_report

Read-only composer update report for a TYPO3 project: a backend module that lists outdated packages and known security advisories, a scheduler task and a CLI command that store the report on a schedule and optionally email it.

Supports TYPO3 13.4 LTS and 14 (PHP 8.2 to 8.4). English and German.

The backend module on a demo installation with TYPO3 14.3.8, an older Guzzle and an old PHPMailer that has known advisories.

What it does

The extension never changes the project. It only ever runs composer outdated (twice: plain and --minor-only) and composer audit with fixed argument lists (enforced by a unit test), or reads composer.lock and composer.json.

Requirements

Installation

extension:setup creates the table tx_pxecomposerreport_domain_model_run and writes the default settings.

Configuration

TYPO3 13.4: Admin Tools > Settings > Extension Configuration > pxe_composer_report\ TYPO3 14: System > Settings > Extension Configuration > pxe_composer_report

The settings are grouped in the tabs Basic (collector, report and history), Privacy, Email and AI summary.

Setting Default Meaning
collectorMode auto composer runs the composer CLI, packagist asks the Packagist API, auto uses composer when proc_open() and the binary are available and falls back to Packagist (with a notice in the module)
composerBinary composer composer (searched in the PATH of the PHP process) or a full path such as /usr/local/bin/composer or /opt/composer.phar (.phar is run with the PHP CLI binary)
projectLabel site name Project name shown in the module and in the email
keepRuns 50 Number of stored runs; older runs are deleted after each run. 0 keeps everything
resolveLatestViaPackagist on Off: the extension itself never contacts packagist.org. The composer collector works without any lookup of its own; the Packagist collector then stops with a clear error
privateVendors – Comma-separated vendor prefixes or full package names, e.g. acme, mycorp/intranet. Never sent to Packagist, the advisories API or the AI summary; listed as "private, not checked" when the Packagist collector is used
emailEnabled off Send the report by email after each scheduled or CLI run
emailRecipients – Comma-separated recipient addresses
emailOnlyOnFindings on Only send when something is outdated or an advisory exists
emailLanguage en en or de; language of the email and of the AI summary
aiEnabled off Generate a short summary with the Anthropic API
anthropicApiKey – API key, required for the summary; stored in the TYPO3 system configuration
anthropicModel claude-haiku-5-5 Model id for the summary; claude-sonnet-5-5 or claude-opus-5-5 for a more capable (and more expensive) one

Extension configuration, tab "Privacy".

The sender address is TYPO3's system mail address ($GLOBALS['TYPO3_CONF_VARS']['MAIL']['defaultMailFromAddress']).

Under php-fpm the HOME variable is often unset; composer then refuses to run. The extension sets COMPOSER_HOME to var/pxe_composer_report/composer-home in that case, so caches land in a writable place. Under cron the environment of the cron user is used as is.

Usage

Backend module

TYPO3 13.4: Admin Tools > Composer Report; TYPO3 14: Administration > Composer Report (the main module "Admin Tools" was renamed). Administrators only. The buttons sit in the module's docheader: Refresh now runs a report immediately (this can take a minute, composer talks to the repositories). Send test mail sends the current report to one address or to the configured recipients. Both are POST requests with a CSRF token.

German interface: screenshot.

Scheduler

Add the task Composer update report (read-only) from the group Composer Report (System > Scheduler in TYPO3 13.4, Administration > Scheduler in TYPO3 14), e.g. weekly. A failed run is stored with status "error" and marks the task execution as failed, so it shows up in the scheduler module.

CLI

Exit codes: 0 no security advisories, 1 security advisories found, 2 the run failed (details on stderr and in the stored run). Suitable for cron and CI, e.g. ... || notify-team.

Email

With emailEnabled on, scheduled and CLI runs (--mail) send the report as HTML with a plain-text alternative:

HTML part of the report email (English).

Run history

Every run is stored in tx_pxecomposerreport_domain_model_run (report as JSON, counts, collector, error). Only the newest keepRuns rows are kept.

Privacy and external connections

Depending on the configuration, the following data leaves the server. Nothing else is sent, and the extension does not read auth.json or any credentials.

When Target Data sent
composer collector every repository configured in the project's composer.json (Packagist and any private registries) whatever composer itself sends for composer outdated and composer audit, using the project's own composer configuration and credentials. Note that composer audit sends the names of all installed packages to the Packagist advisories API (composer behaviour; see composer's audit.ignore / repository settings to restrict it). The extension itself makes no request in this mode
packagist collector https://repo.packagist.org/p2/<vendor>/<package>.json one GET per direct dependency that is not in privateVendors; the package name is part of the URL
packagist collector https://packagist.org/api/security-advisories/ names of all direct dependencies that are not in privateVendors
any row without a within-major version (defensive fallback; does not happen with the shipped collectors) and resolveLatestViaPackagist on https://repo.packagist.org/p2/<vendor>/<package>.json the package name, unless in privateVendors
aiEnabled on https://api.anthropic.com/v1/messages package counts; for each security advisory the package name, severity, CVE and title; for each outdated TYPO3 package the name, installed version, latest version, next major and impact. Packages in privateVendors are removed first. No host names, paths, descriptions, links or user data. The model id and the API key go in the request as well
emailEnabled on / test mail the TYPO3 mail transport the complete report, to the configured recipients

resolveLatestViaPackagist = 0 guarantees that the extension itself never opens a connection to packagist.org. privateVendors guarantees that the listed packages never appear in any request made by the extension itself. All requests expose the server's IP address to the target.

Optional integration

If the (separate) extension pxe_hub is installed, the report also appears as a card in its overview module. Without it, nothing changes; the integration is registered only when pxe_hub is present.

Development

The functional tests run the whole pipeline against a fake composer binary (Tests/Functional/Fixtures/composer/); no test needs network access.

Releases: bump version in ext_emconf.php, add a CHANGELOG.md entry, push a tag vX.Y.Z. The workflow .github/workflows/publish-ter.yml uploads the tag to the TYPO3 Extension Repository with typo3/tailor (secret TYPO3_API_TOKEN, scope extension:write).

Changelog

See CHANGELOG.md.

License

GPL-2.0-or-later, see LICENSE.txt. Made by pixelegg.

All versions of pxe-composer-report with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
psr/http-message Version ^1.1 || ^2.0
psr/log Version ^2.0 || ^3.0
symfony/console Version ^6.4 || ^7.0
symfony/process Version ^6.4 || ^7.0
typo3/cms-backend Version ^13.4 || ^14.0
typo3/cms-core Version ^13.4 || ^14.0
typo3/cms-fluid Version ^13.4 || ^14.0
typo3/cms-scheduler Version ^13.4 || ^14.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package pixelegg/pxe-composer-report contains the following files

Loading the files please wait ...