Dependency Audit & CVE Scanning
debt(d3/e3/b3/t5)
Closest to 'default linter catches the common case' (d3). The term's detection_hints lists composer-audit, snyk, dependabot, and roave/security-advisories — all are readily available automated tools that catch missing audit steps or known CVEs. These integrate easily into CI and flag vulnerabilities without specialist configuration, though they require explicit setup rather than being compiler-level.
Closest to 'simple parameterised fix' (e3). The quick_fix is 'Run composer audit in CI; fail the build on any critical or high severity CVE' — this is a small CI configuration change. However, actually remediating found CVEs may require updating dependencies, which can touch multiple files if breaking changes exist, hence e3 rather than e1.
Closest to 'localised tax' (b3). Dependency auditing applies broadly (web/api/cli contexts per applies_to) but the practice itself is a CI/DevOps concern that doesn't impose structural weight on application code. Once configured, it runs automatically. The burden is ongoing maintenance of dependency updates, but this is localized to the dependency management layer, not cross-cutting through business logic.
Closest to 'notable trap' (t5). The misconception explicitly states developers believe 'auditing once at project start is sufficient' when CVEs are disclosed daily. The common_mistakes reinforce this: only auditing direct dependencies (missing transitive ones), ignoring moderate CVEs, and not updating after audit. These are documented gotchas that experienced developers eventually learn, but trip up many initially.
Also Known As
TL;DR
Explanation
Every dependency is potential attack surface. CVE databases (National Vulnerability Database, GitHub Advisory Database) track known vulnerabilities with severity scores. Tools: composer audit (built-in, checks against GitHub Advisory), npm audit, Snyk, Dependabot (GitHub). Best practice: run in CI on every PR, fail the build on high-severity CVEs, automate dependency updates (Dependabot, Renovate). PHP-specific: track phpstan/phpstan, laravel/framework, symfony/* for security releases. Sign up to security mailing lists for frameworks you use.
Common Misconception
Why It Matters
Common Mistakes
- No audit step in CI — vulnerabilities are only caught when someone manually checks.
- Ignoring moderate CVEs — many critical exploits start as moderate severity findings.
- Not updating after audit — knowing about a vulnerability without fixing it provides no protection.
- Only auditing direct dependencies — transitive dependencies (dependencies of dependencies) are equally dangerous.
Code Examples
# No audit in CI — vulnerable packages silently deployed:
# .github/workflows/ci.yml:
steps:
- run: composer install
- run: vendor/bin/phpunit
# No audit step
# symfony/http-kernel with known RCE deployed to production# Audit in CI — blocks deployment on high CVEs:
steps:
- run: composer install
- run: composer audit --no-dev # Fail on any vulnerability
- run: vendor/bin/phpunit
# .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: composer
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10