Ecosystem · PHP · Composer
Vulnerabilities in your PHP projects, and in your PHP version.
LibWatch reads composer.json and composer.lock, checks every Packagist package and tracks the end of life of your PHP branch. Symfony, Laravel, Drupal or custom PHP: the same analysis.
What LibWatch reads in the repository
composer.jsoncomposer.lock
Language version: config.platform.php or require.php
Nothing else: no cloning, no code run.
What LibWatch checks
The packages, and the layer below
Packagist packages
Known vulnerabilities
Every package in the lockfile checked against OSV, which includes GitHub advisories.
PHP version
End of life
The declared version is tracked: you know when it stops getting fixes.
Health
License policy
Licenses that conflict with your project's policy are flagged.
An alert, in practice
A Composer vulnerability, with the version that fixes it
Not 300 lines: the vulnerabilities that affect your versions, with the fixed version.
Real severity
CVSS severity and presence in the CISA KEV catalog
What to do
The fixed version, and the affected project
Where
Email, Slack, Zulip or webhook, set per project
orders-api · Symfony
Example · analysis from October 22
-
End of life
PHP (declared)
^8.1
-
Medium severity
symfony/http-kernel
v6.4.1
-
Up to date
guzzlehttp/guzzle
7.8.1
Rechecked every night at 2 a.m.
End of life
Where your PHP branch stands
Official php.net schedule, checked on October 22, 2026.
| Branch | Fixed version | Support | Action |
|---|---|---|---|
| 8.5 | 8.5.12 | Active · security → 2029 | Stay up to date |
| 8.4 | 8.4.27 | Active · security → 2028 | Stay up to date |
| 8.3 | 8.3.36 | Security only → 2027 | Plan the upgrade |
| 8.2 | 8.2.35 | Ends December 31, 2026 | Upgrade before year end |
| 8.1 | none | Ended December 31, 2025 | Upgrade now |
Dates checked on October 22, 2026.
Get started
Your first report in a few minutes
No pipeline to change.
Connect GitHub or GitLab
Self-hosted GitLab instances included.
Choose your PHP repositories
LibWatch finds the files listed above on its own, even in a monorepo.
Read the report, set up alerts
Exploited vulnerabilities first, fixed versions, language end of life.
Frequently asked questions
LibWatch and PHP
composer.lock or composer.json?
Both. composer.lock gives the exact versions; composer.json gives the expected PHP version.
Are private Packagist and Satis supported?
Yes. A package distributed outside Packagist (Satis, Private Packagist, local repository) is identified as private: its name is never sent to a third-party service, and it stays in the project's inventory.
Does LibWatch see the PHP version on the server?
No. It reads the version declared in composer.json (config.platform.php, otherwise require.php). It has no access to your servers.