Skip to content

PHP

Trivy supports Composer, which is a tool for dependency management in PHP.

The following scanners are supported.

Package manager SBOM Vulnerability License
Composer

The following table provides an outline of the features Trivy offers.

Package manager File Transitive dependencies Dev dependencies Dependency graph Position
Composer composer.lock Excluded
Composer installed.json Excluded -

composer.lock

In order to detect dependencies, Trivy searches for composer.lock.

Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in composer.lock, Trivy parses composer.json, which should be located next to composer.lock. If you want to see the dependency tree, please ensure that composer.json is present.

installed.json

Trivy also supports dependency detection for installed.json files. By default, you can find this file at path_to_app/vendor/composer/installed.json.