# Roave/SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily

Repository: https://github.com/Roave/SecurityAdvisories
Canonical: https://ross.abutalabs.com/products/securityadvisories
License: MIT
License Family: permissive
Topics: php, security-advisories, security-vulnerability, composer, infosec, security-vulnerabilities
Last push: 2026-08-26T16:17:55+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 4319, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2914, forks 112 (observed 2026-08-28T04:07:29.921804+00:00)

## What it is
A Composer package that acts as an exclusion list of known security vulnerabilities, preventing installation of dependency versions with documented security issues. It is updated frequently and requires no API—simply add it to require-dev to block vulnerable packages.

## Use cases
- prevent installing composer packages with known vulnerabilities
- block vulnerable dependency versions in php projects
- supply chain security for composer dependencies
- check if composer update would pull insecure packages
- enforce security advisories in php dependency management

## When to choose
- you use Composer and want automatic blocking of known-vulnerable package versions
- you want a zero-config, dependency-free security guard during require/update

## When to avoid
- you need runtime vulnerability scanning or auditing of an existing composer.lock (use composer audit or similar tools)
- your project does not use PHP/Composer

## Facets
- artifact type: library
- maturity: active
- function: security, dependency-audit, package-manager
- domain: security, developer-tools
- platform: php, cli
- tags: composer, security-advisories, supply-chain-security, vulnerability-blocking, php

## Member repositories
- Roave/SecurityAdvisories (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:29.921804+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:34:07.579615+00:00, confidence not recorded.
  - readme: https://github.com/Roave/SecurityAdvisories (fetched 2026-08-28T04:07:29.921804+00:00, sha 15aa92aaa432)
- Data as of 2026-08-30T08:39:29.467469+00:00.