awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
Roave avatar

Roave/SecurityAdvisories

0
View on GitHub↗

SecurityAdvisories

SecurityAdvisories is a software composition analysis tool and PHP security advisory database used to audit project dependencies against known security flaws and CVEs. It functions as a vulnerability scanner for PHP projects to identify and manage risky third-party libraries.

The project implements a system for detecting and blocking vulnerable dependencies during the software development lifecycle. It prevents the installation of software packages with known security flaws by maintaining an exclusion list of forbidden versions.

The tool integrates with the PHP package manager to intercept dependency resolution and analyze lockfiles. It utilizes a static security database with a structured JSON schema to match requested version constraints against known vulnerable ranges.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Dependency Vulnerability Scanners - Provides a vulnerability scanner for PHP project dependencies using a security advisory database.
  • Security Advisories - Maintains a comprehensive database of known security vulnerabilities and advisories for PHP packages.
  • Static JSON Stores - Stores vulnerability metadata in read-only JSON files for fast lookup.
  • Version Constraints - Compares requested dependency versions against known vulnerable ranges.
  • Dependency Blocking - Prevents the installation of specific package versions by matching them against a curated list of security vulnerabilities.
  • Software Composition Analysis Tools - Acts as a software composition analysis tool to detect and block vulnerable third-party libraries.
  • Software Supply Chain Security - Ensures third-party dependencies do not introduce security vulnerabilities into the codebase.
  • Lockfile Integrity Validators - Scans project lockfiles against security policies to detect insecure dependencies.
  • Secure Dependency Workflows - Implements a workflow to maintain a list of forbidden software versions to avoid security risks.
  • Package Manager Plugins - Integrates as a Composer plugin to intercept dependency resolution and apply security constraints.
  • Security and Encryption - Prevents installation of dependencies with known vulnerabilities.
  • Vulnerability Monitoring - Prevents the installation of packages with known security vulnerabilities.
2,871 stars·111 forks·mit·21 views

Star history

Star history chart for roave/securityadvisoriesStar history chart for roave/securityadvisories

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Projects sharing features with SecurityAdvisories

These projects share indexed features with SecurityAdvisories. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • snyk/snyksnyk avatar

    snyk/snyk

    5,586View on GitHub↗

    Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source code, open-source dependencies, container images, and infrastructure-as-code configurations. It functions as a comprehensive security workflow automation tool, utilizing a static analysis engine and dependency graph mapping to detect security flaws and license compliance issues throughout the software development lifecycle. The platform distinguishes itself through agentic workflow orchestration and an automated remediation pipeline that generates and submits pull requests to patc

    TypeScript
    View on GitHub↗5,586
  • lirantal/npm-security-best-practiceslirantal avatar

    lirantal/npm-security-best-practices

    1,178View on GitHub↗

    This project provides a comprehensive framework for securing the software supply chain within the Node.js ecosystem. It focuses on mitigating risks associated with third-party dependencies by implementing technical controls and governance policies designed to prevent malicious code injection and ensure the integrity of the development environment. The guide distinguishes itself by offering specific hardening techniques for package management, such as disabling automatic execution of lifecycle scripts and enforcing strict registry-scoped dependency routing to prevent dependency confusion. It e

    awesomeawesome-listbest-practices
    View on GitHub↗1,178
  • google/osv-scannergoogle avatar

    google/osv-scanner

    10,565View on GitHub↗

    osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and container images against the Open Source Vulnerabilities database. It functions as a dependency remediation tool and can be integrated into custom Go applications as a programmable security library. The project distinguishes itself through a remediation workflow that includes an interactive terminal user interface and automated scripting for upgrading vulnerable packages in lockfiles and manifests. It employs call-graph reachability analysis to determine if vulnerable code is act

    Goscannersecurity-auditsecurity-tools
    View on GitHub↗10,565
  • bodadotsh/npm-security-best-practicesbodadotsh avatar

    bodadotsh/npm-security-best-practices

    761View on GitHub↗

    This project provides a comprehensive guide for securing the software supply chain within Node.js and npm environments. It focuses on hardening the entire lifecycle of third-party dependencies and package publishing processes to protect applications from malicious code injection and unauthorized registry modifications. The guide distinguishes itself by emphasizing identity-based authentication and cryptographic provenance to verify the origin of distributed artifacts. It advocates for strict governance policies, such as enforcing minimum release ages for dependencies and disabling automatic l

    awesomedenojavascript
    View on GitHub↗761
Compare all 30 related projects→

Frequently asked questions

What does roave/securityadvisories do?

SecurityAdvisories is a software composition analysis tool and PHP security advisory database used to audit project dependencies against known security flaws and CVEs. It functions as a vulnerability scanner for PHP projects to identify and manage risky third-party libraries.

What are the main features of roave/securityadvisories?

The main features of roave/securityadvisories are: Dependency Vulnerability Scanners, Security Advisories, Static JSON Stores, Version Constraints, Dependency Blocking, Software Composition Analysis Tools, Software Supply Chain Security, Lockfile Integrity Validators.

Which projects share features with roave/securityadvisories?

Projects with overlapping indexed features include: snyk/snyk — Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source… lirantal/npm-security-best-practices — This project provides a comprehensive framework for securing the software supply chain within the Node.js ecosystem.… google/osv-scanner — osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and… bodadotsh/npm-security-best-practices — This project provides a comprehensive guide for securing the software supply chain within Node.js and npm… analysis-tools-dev/static-analysis — This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It… bridgecrewio/checkov — Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as…