Registry / devops / snyk-php-plugin

snyk-php-plugin

library1.12.1jsnpmunverified

The `snyk-php-plugin` is a specialized plugin designed to extend the Snyk Command Line Interface (CLI) functionality for PHP Composer projects. Its primary role is to provide dependency metadata from `composer.json` and `composer.lock` files, enabling Snyk to identify, fix, and monitor known security vulnerabilities in PHP applications. The current stable version is 1.12.1, with recent releases indicating an active development cadence, including features like improved Composer command handling, Prettier integration, and enhanced security scanning capabilities. As a plugin, it is not intended for standalone programmatic use but integrates directly with the Snyk CLI to provide comprehensive security analysis for PHP dependencies, distinguishing it from general-purpose static analysis tools or package managers.

devops auth-security

npm install snyk-php-plugin

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SNYK-PHP-PLUGIN

snyk-php-plugin

devopsjavascriptv1.12.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

plugin

✓ import { plugin } from 'snyk-php-plugin';

This represents the main plugin interface, primarily for internal Snyk CLI consumption or advanced custom integrations. Direct end-user programmatic import is not the standard use case.

getDepsFromProject

✓ import { getDepsFromProject } from 'snyk-php-plugin';

A utility function to programmatically extract dependencies from a PHP project, potentially useful for custom tooling interacting with Snyk's dependency resolution logic.

PhpPluginResult

✓ import type { PhpPluginResult } from 'snyk-php-plugin';

Represents the TypeScript type definition for the results returned by the PHP plugin, valuable for type-safe programmatic interactions or custom analysis.

This quickstart demonstrates how to programmatically use the `getDepsFromProject` function from the snyk-php-plugin. It simulates a basic PHP Composer project structure and then invokes the plugin's core logic to extract dependency information, printing the detected packages and their versions. While the primary use is via the Snyk CLI, this example illustrates direct interaction with the plugin's internal functions.

import { writeFileSync, mkdirSync } from 'node:fs'; import { join } from 'node:path'; import { getDepsFromProject } from 'snyk-php-plugin'; // Create a dummy PHP project directory for demonstration const projectDir = join(process.cwd(), 'temp-php-project'); mkdirSync(projectDir, { recursive: true }); // Simulate composer.json and composer.lock files writeFileSync(join(projectDir, 'composer.json'), JSON.stringify({ "name": "vendor/package", "description": "A dummy PHP package", "require": { "monolog/monolog": "^2.0", "php": ">=7.4" }, "require-dev": { "phpunit/phpunit": "^9.5" } }, null, 2)); writeFileSync(join(projectDir, 'composer.lock'), `{ "packages": [ { "name": "monolog/monolog", "version": "2.0.0", "source": { "type": "git", "url": "https://github.com/Seldaek/monolog.git", "reference": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0" }, "require": { "php": ">=7.2" } } ], "packages-dev": [ { "name": "phpunit/phpunit", "version": "9.5.0", "source": { "type": "git", "url": "https://github.com/sebastianbergmann/phpunit.git", "reference": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0" }, "require": { "php": ">=7.3" } } ] }`); async function scanPhpProject() { console.log(`Scanning PHP project at: ${projectDir}`); try { // In a real scenario, Snyk CLI would call this plugin internally. // Here, we demonstrate direct programmatic access to getDepsFromProject. const result = await getDepsFromProject(projectDir, { args: [], path: [] }); console.log('Detected PHP dependencies:'); result.plugin.package.dependencies.forEach(dep => { console.log(`- ${dep.name}@${dep.version}`); }); } catch (error) { console.error('Error during dependency scan:', error.message); } } scanPhpProject();

Debug

Known issues

breakingThe package requires Node.js version 18 or newer. Older Node.js environments (e.g., Node.js 16) are not supported and will lead to execution failures.

fix

Upgrade your Node.js runtime to version 18 or higher. Use `nvm install 18 && nvm use 18` or similar version management tools.

affects: <1.12.0

gotchaThis package is a plugin for the Snyk CLI and is primarily designed to be invoked by the Snyk CLI tool. Direct programmatic imports and usage, while possible for some internal functions, are not the standard or recommended way to use this library for vulnerability scanning.

fix

For vulnerability scanning, install the Snyk CLI (`npm install -g snyk`) and run `snyk test` or `snyk monitor` in your PHP project directory.

affects: >=1.0.0

gotchaRecent updates in version 1.12.0 improved Composer command handling. If you're running custom environments or older Composer versions, ensure compatibility.

fix

Test your Snyk CLI setup with your specific Composer environment after updating the plugin. Ensure your Composer installation is up-to-date and accessible in the system's PATH.

affects: >=1.12.0

gotchaFor Snyk to properly analyze PHP projects, both `composer.json` and `composer.lock` files must be present in the project root. Missing `composer.lock` can lead to incomplete or failed scans.

fix

Run `composer install` or `composer update` in your PHP project to generate or update the `composer.lock` file before running Snyk scans.

affects: >=1.0.0

Errors

Common errors & fixes

Error: Node.js v16.x is not supported. Please upgrade to Node.js v18.x or higher.

Running the plugin in an unsupported Node.js environment.

fix

Upgrade your Node.js version to 18 or higher. Use `nvm install 18 && nvm use 18` or similar tools.

Error: Command failed: composer --version (or similar composer error)

The Composer executable is not found in the system's PATH or PHP/Composer is not installed/configured correctly.

fix

Ensure PHP and Composer are correctly installed and their executables are available in your system's PATH. You can test this by running `composer --version` in your terminal.

Could not find a manifest file (composer.json or composer.lock) for this project.

The Snyk CLI or plugin could not locate the necessary Composer manifest files in the directory being scanned.

fix

Navigate to the root directory of your PHP project where `composer.json` and `composer.lock` reside, or ensure these files exist. Run `composer install` if `composer.lock` is missing.

No vulnerabilities found.

This is often not an error, but if expected vulnerabilities are not found, it might indicate an issue with scanning scope or configuration.

fix

Verify that your `composer.lock` is up-to-date. Ensure you are scanning the correct project directory. Consider scanning with `--dev` flag if development dependencies are relevant. Check Snyk platform settings for scan exclusions.

Upgrade

Version history

1.12.1latest on npm

Audit

Dependencies

snykrequiredThis package is a plugin for the Snyk CLI and requires the Snyk CLI to be installed globally or available in the execution environment.

noderequiredRequires Node.js runtime version 18 or higher as specified in the package engines. Running with older versions will lead to errors.

phprequiredRequires a functional PHP environment with Composer installed to analyze PHP project dependencies.

Agent activity

12 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/snyk/snyk-php-plugin ↗

packagehttps://www.npmjs.com/package/snyk-php-plugin ↗

homepagehttps://snyk.io ↗