> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: composer audit
- URL: https://securinglaravel.com/security-tip-composer-audit/
- Published: 2022-08-09T08:00:14.000Z
- Updated: 2025-01-07T05:24:00.000Z
- Description: [Tip#28] Composer 🥰
- Author: Stephen Rees-Carter
- Tags: Security Tips, Composer, Supply Chain, Dependencies

As PHP developers, we’re lucky enough to have [Composer](https://getcomposer.org/?ref=securinglaravel.com) as our package manager. It is, in my opinion, the best package manager available and doesn’t suffer from the multitude of problems and annoyances that others like NPM do.

An awesome feature that was added [Composer v2.4](https://github.com/composer/composer/releases/tag/2.4.0?ref=securinglaravel.com) is the [audit command](https://getcomposer.org/doc/03-cli.md?ref=securinglaravel.com#audit):

```
composer audit
```

Similar to `npm audit`, the `composer audit` command will check your currently installed package versions for any known security vulnerabilities and list any that are found.

Composer will also automatically run an audit during an update via `composer update`, and you can optionally include it during installs with the `--audit` flag.

Security advisories are [loaded from Packagist](https://packagist.org/apidoc?ref=securinglaravel.com#list-security-advisories), which sources them from GitHub and `FriendsOfPHP/security-advisories`, with scope for more sources as required.

I think this is an awesome addition to Composer, and something it had been lacking prior to v2.4, so it’s great to see it included. There are [other third-party packages](https://github.com/fabpot/local-php-security-checker?ref=securinglaravel.com) [that serve similar roles](https://github.com/Roave/SecurityAdvisories?ref=securinglaravel.com), but having it included in Composer makes it a lot more accessible.

I highly recommend adding `composer audit` call into your testing and deployment pipeline, so you’ll be alerted for new vulnerabilities as they are reported.

You can find the official documentation of the command here:  
[https://getcomposer.org/doc/03-cli.md#audit](https://getcomposer.org/doc/03-cli.md?ref=securinglaravel.com#audit)

**~~But, it’s not here yet…~~**

~~The new audit command is coming in v2.4, but it hasn’t been released yet. There is a release candidate available though, so you can use if you want to try out the command.~~

~~Find it here:~~ [~~https://github.com/composer/composer/releases/tag/2.4.0-RC1~~](https://github.com/composer/composer/releases/tag/2.4.0-RC1?ref=securinglaravel.com)

~~Or install it with:~~

```
composer self-update --preview
```

~~And switch back to the latest stable v2.3:~~

```
composer self-update --stable
```

*(I wrote this article before it was officially released.)*

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*