composer audit checks your project’s composer.lock file against a database of known security advisories for PHP packages, similar in purpose to npm audit for the Node.js ecosystem.
How it works
- Reads the exact locked versions in
composer.lock, not just what’s declared incomposer.json - Reports matching advisories with severity, affected version ranges, and a link to details
- Exits with a non-zero status code when advisories are found — standard behavior for CI tools, meant to signal "found something," not that the command itself failed
Practical use
Run it as part of routine maintenance or CI, and treat a non-zero exit code as informational rather than a broken build indicator when reviewing results manually — the two mean different things and are easy to conflate when automating around it.
FAQ
Does composer audit fix vulnerabilities automatically?
No — unlike some JavaScript tooling, it only reports; you still need to run composer update on the specific affected packages yourself.