{"id":26862129,"url":"https://github.com/mxr576/ddqg-composer-audit","last_synced_at":"2025-07-11T02:35:49.975Z","repository":{"id":153778691,"uuid":"630620856","full_name":"mxr576/ddqg-composer-audit","owner":"mxr576","description":"Drupal Dependency Quality Gate Composer Audit plugin","archived":false,"fork":false,"pushed_at":"2024-12-21T20:58:07.000Z","size":758,"stargazers_count":10,"open_issues_count":8,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-05-06T21:09:18.702Z","etag":null,"topics":["audit","composer-plugin","dependency-analysis","drupal","onion-architecture","security"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mxr576.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-20T19:21:43.000Z","updated_at":"2025-04-24T15:04:57.000Z","dependencies_parsed_at":"2024-02-09T21:23:05.565Z","dependency_job_id":"a7eb7211-412a-4879-b477-379a4ee8bc94","html_url":"https://github.com/mxr576/ddqg-composer-audit","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mxr576%2Fddqg-composer-audit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mxr576%2Fddqg-composer-audit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mxr576%2Fddqg-composer-audit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mxr576%2Fddqg-composer-audit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mxr576","download_url":"https://codeload.github.com/mxr576/ddqg-composer-audit/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252769422,"owners_count":21801378,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","composer-plugin","dependency-analysis","drupal","onion-architecture","security"],"created_at":"2025-03-31T02:23:25.335Z","updated_at":"2025-05-06T21:09:30.510Z","avatar_url":"https://github.com/mxr576.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"Drupal Dependency Quality Gate Composer Audit plugin\n---\n\nThis project extends `composer audit` command with new \"advisories\" originating from the results generated by the\n[mxr576/ddqg](https://packagist.org/packages/mxr576/ddqg) project that aims to help run Drupal projects on secure and high-quality\nDrupal dependencies.\n\n\u003cimg alt=\"Family Guy, Consuela says: No, no, no low-quality dependencies\" height=\"250\" src=\"https://i.imgflip.com/7ijrpx.jpg\"/\u003e\n\n**CHECKOUT** the [mxr576/composer-audit-changes](https://packagist.org/packages/mxr576/composer-audit-changes)\n\"alternative\" `composer audit` command because it can help with the adoption of this package on existing projects\nwith collected technical debt.\n\n## Installation\n\n```shell\n$ composer require --dev mxr576/ddqg-composer-audit\n```\n\n## Example output\n\n```\n$ composer audit\n+-------------------+----------------------------------------------------------------------------------+\n| Package | drupal/apigee_edge |\n| CVE | DDQG-D10-incompatible-drupal-apigee_edge |\n| Title | The installed \"2.0.7.0\" version is not compatible with Drupal 10. (Reported by D |\n| | rupal Dependency Quality Gate.) |\n| URL | https://www.drupal.org/project/apigee_edge |\n| Affected versions | 2.0.7.0 |\n| Reported at | 2023-05-07T13:49:57+00:00 |\n+-------------------+----------------------------------------------------------------------------------+\n+-------------------+----------------------------------------------------------------------------------+\n| Package | drupal/apigee_edge |\n| CVE | DDQG-insecure-drupal-apigee_edge |\n| Title | The installed \"2.0.7.0\" version is insecure. (Reported by Drupal Dependency Qual |\n| | ity Gate.) |\n| URL | https://www.drupal.org/project/apigee_edge |\n| Affected versions | \u003e=1.0.0,\u003c1.27.0|\u003e=2.0.0,\u003c2.0.8 |\n| Reported at | 2023-05-07T13:49:57+00:00 |\n+-------------------+----------------------------------------------------------------------------------+\n+-------------------+----------------------------------------------------------------------------------+\n| Package | drupal/core |\n| CVE | DDQG-insecure-drupal-core |\n| Title | The installed \"9.4.0.0\" version is insecure. (Reported by Drupal Dependency Qual |\n| | ity Gate.) |\n| URL | https://www.drupal.org/project/core |\n| Affected versions | \u003e=9.4.0,\u003c9.4.14|\u003e=9.5.0,\u003c9.5.8|\u003e=10.0.0,\u003c10.0.8 |\n| Reported at | 2023-05-07T13:49:57+00:00 |\n+-------------------+----------------------------------------------------------------------------------+\n+-------------------+----------------------------------------------------------------------------------+\n| Package | drupal/feeds |\n| CVE | DDQG-unsupported-drupal-feeds-3.0.0.0-beta3 |\n| Title | The installed \"3.0.0.0-beta3\" version is unsupported. (Reported by Drupal Depend |\n| | ency Quality Gate.) |\n| URL | https://www.drupal.org/project/feeds |\n| Affected versions | 2.x-dev|3.0.0-alpha1|3.0.0-alpha2|3.0.0-alpha3|3.0.0-alpha4|3.0.0-alpha5|3.0.0-a |\n| | lpha6|3.0.0-alpha7|3.0.0-alpha8|3.0.0-alpha9|3.0.0-alpha10|3.0.0-alpha11|3.0.0-b |\n| | eta1|3.0.0-beta2|3.0.0-beta3|3.x-dev |\n| Reported at | 2023-05-07T13:49:57+00:00 |\n+-------------------+----------------------------------------------------------------------------------+\n+-------------------+----------------------------------------------------------------------------------+\n| Package | drupal/variationcache |\n| CVE | DDQG-deprecated-drupal-variationcache-1.2.0.0 |\n| Title | The installed \"1.2.0.0\" version is deprecated. (Reported by Drupal Dependency Qu |\n| | ality Gate.) |\n| URL | https://www.drupal.org/project/variationcache |\n| Affected versions | * |\n| Reported at | 2024-01-08T12:15:20+00:00 |\n+-------------------+----------------------------------------------------------------------------------+\n```\n\n## Configuration\n\nQuality Assurance can feel painful, but it is an important part of professional software development. The goal of this\nproject is to bring attention about dependency quality problems on a project. For all these reasons, it deliberately\ncomes with minimal opt-out options.\n\n### Silence warning about a deprecated- or unsupported package version in use\n\n\u003e [!WARNING]\n\u003e This feature is **deprecated** and it is going to be removed in version 2.0.0. Composer's built-in [audit ignore](https://getcomposer.org/doc/06-config.md#ignore) feature replaced it.\n\nIn a project's root composer.json, under the `extra` property, add a definition like this:\n\n```json\n \"ddqg-composer-audit\": {\n \"ignore-deprecated-versions\": {\n \"vendor/package\": \"an_explicit_version_string\",\n \"drupal/swiftmailer\": \"2.4.0\"\n }\n \"ignore-unsupported-versions\": {\n \"vendor/package\": \"an_explicit_version_string\",\n \"drupal/tamper\": \"1.0.0-alpha3\"\n }\n }\n```\n\nThe other option is defining a comma separate list of ignore rules in\n`DDQG_COMPOSER_AUDIT_IGNORE_DEPRECATED_VERSIONS` and `DDQG_COMPOSER_AUDIT_IGNORE_UNSUPPORTED_VERSIONS` environment\nvariables respectfully, e.g,\n`DDQG_COMPOSER_AUDIT_IGNORE_DEPRECATED_VERSIONS=drupal/swiftmailer:2.4.0,vendor/package:1.x-dev` or\n`DDQG_COMPOSER_AUDIT_IGNORE_UNSUPPORTED_VERSIONS=drupal/tamper:1.0.0-alpha3,vendor/package:1.x-dev`\n\nAn environment variable has a higher precedence than a configuration in composer.json; if it is defined, the definition in a project's root composer.json is\nignored completely.\n\nNotice: A warning is still displayed about the ignored deprecated- or unsupported package on STDERR.\n\n**Not supporting version ranges in the definition was a conscious decision because (again) the goal is making\ndependency quality problems constantly visible and not sweeping them under the carpet.**\n\n### Check Drupal 10 compatibility\n\nFor projects running on Drupal 9 still. When this feature is enabled then `composer audit` can also check whether an\ninstalled package dependency version is also compatible with Drupal 10 or not. This can make the Drupal 10 upgrade more\npainless.\n\n**The feature is disabled by default**, it can be enabled with:\n\n```json\n \"ddqg-composer-audit\": {\n \"check-d10-compatibility\": true\n }\n```\n\nor by setting the `DDQG_COMPOSER_AUDIT_CHECK_D10_COMPATIBILITY=true` environment variable.\n\n**This is a seasonal feature that will be removed after Drupal 9 EOL.**\n\n## Integrations\n\n* \"Unofficial\" [build definition](https://gist.github.com/mxr576/5f87063eb2e1e2b125257878018f048d) for a Docker\n image that installs the latest version from this Composer plugin and the [composer audit-changes](https://packagist.org/packages/mxr576/composer-audit-changes)\n command\n\n## FAQ\n\n### Drupal Packagist already provides package advisories, so why should I care about this plugin?\n\nThis feature is only available on Drupal Packagist since 21 September 2023. Security advisory data via\nDrupal Packagist only contains information based on published security advisories; it does not contain\nreleases flagged as [\"insecure\"](https://www.drupal.org/taxonomy/term/188131), but this Composer plugin does.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmxr576%2Fddqg-composer-audit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmxr576%2Fddqg-composer-audit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmxr576%2Fddqg-composer-audit/lists"}