@@ -5,13 +5,19 @@ How to Check for Known Security Vulnerabilities in Your Dependencies
5
5
====================================================================
6
6
7
7
When using lots of dependencies in your Symfony projects, some of them may
8
- contain security vulnerabilities. That's why Symfony includes a command called
9
- ``security:check `` that checks your ``composer.lock `` file to find any known
10
- security vulnerability in your installed dependencies:
8
+ contain security vulnerabilities. That's why the Symfony client includes a
9
+ command called ``security:check `` that checks your ``composer.lock `` file to
10
+ find known security vulnerabilities in your installed dependencies:
11
11
12
12
.. code-block :: terminal
13
13
14
- $ php bin/console security:check
14
+ $ symfony security:check
15
+
16
+ .. tip ::
17
+
18
+ The Symfony client is distributed as a free installable binary without any
19
+ dependency and support for Linux, macOS and Windows. Go to `symfony.com/download `_
20
+ and follow the instructions for your operating system.
15
21
16
22
A good security practice is to execute this command regularly to be able to
17
23
update or replace compromised dependencies as soon as possible. Internally,
@@ -25,24 +31,10 @@ FriendsOfPHP organization.
25
31
This way you can add it to your project build process and your continuous
26
32
integration workflows to make them fail when there are vulnerabilities.
27
33
28
- .. note ::
29
-
30
- To enable the ``security:check `` command, make sure the
31
- `SensioDistributionBundle `_ is installed and enabled in your application.
32
-
33
- .. note ::
34
-
35
- Make sure that the installed version of the security checker package is at
36
- least 5.0 (run ``composer show sensiolabs/security-checker `` to show it).
37
- Older versions checked the security vulnerabilities using a URL that is no
38
- longer available and the command execution will result in an error.
39
-
40
34
.. tip ::
41
35
42
- The security checker is also available as an independent console application
43
- and distributed as a PHAR file so you can use it in any PHP application.
44
- Check out the `Security Checker repository `_ for more details.
36
+ The security check is done locally: the `security advisories database `_ is
37
+ cloned and your ``composer.lock `` file is not sent on the network.
45
38
39
+ .. _`symfony.com/download` : https://symfony.com/download
46
40
.. _`security advisories database` : https://github.com/FriendsOfPHP/security-advisories
47
- .. _`SensioDistributionBundle` : https://github.com/sensiolabs/SensioDistributionBundle
48
- .. _`Security Checker repository` : https://github.com/sensiolabs/security-checker
0 commit comments