Free tool · PHP and Composer

Is your PHP project exposed?

Drop your composer.lock: you instantly see the PHP version it expects and when that version reaches end of life. The full vulnerability report arrives by email.

  1. Drop the file

    Preferably composer.lock: it gives the exact versions.

  2. Read the preview

    Computed in your browser, before anything is sent.

  3. Get the report

    Vulnerabilities in your packages and in the PHP engine, then an alert if a new vulnerability affects you.

A composer.lock doesn't contain your code, only the list of your dependencies. We keep only that list, and for 14 days at most.

Composer checker Step 1 of 3

Drop composer.lock or composer.json

or paste its contents · 512 KB max

After you send it

What you'll receive, and nothing more

The report arrives within a few minutes. If you tick the box and then activate monitoring with one click in the email, LibWatch watches the list for 14 days and only emails you when it matters. The emails stop as soon as you create an account.

  1. Within a few minutes

    Your report

    PHP version, vulnerabilities found in your packages and in the engine, and what to fix first.

  2. Nightly, 14 days if the box is ticked

    An alert, only when needed

    When a new vulnerability affects a version on your list. Monitoring lasts 14 days: after that, a composer.lock uploaded once no longer describes your project.

  3. 2 days later if the box is ticked

    The details in LibWatch

    The vulnerability, how likely it is to be exploited, the fixed version.

  4. 5 days later if the box is ticked

    End of life explained

    PHP 8.2 reaches end of life on December 31, 2026: what it means for you.

  5. 9 days later if the box is ticked

    Monitor all your projects

    Connect GitHub, GitLab or a WordPress site in two minutes.

  6. 12 days later if the box is ticked

    For agencies and IT service providers

    One report per project, share links, the Agency plan.

  7. 14 days later if the box is ticked Last email

    End of monitoring and summary

    The 14-day summary: vulnerabilities found, PHP version, next end-of-life date. Then monitoring stops and your package list is deleted.

Your data

What's kept, and what never is

Kept

  • Your email address
  • The name and version of each package, for 14 days
  • The declared PHP version, for 14 days

Never kept

  • The file itself
  • Your Composer scripts and private repository URLs
  • Your code: it isn't in this file

Deleted

  • Your email address, in one click from any message
  • Your package list, after 14 days
  • Everything, just ask the team

Frequently asked questions

Before you upload your file

composer.json or composer.lock: which one should I use?
composer.lock. It contains the exact installed versions; composer.json only gives ranges, such as ^8.1, so the report will be less precise.
Does the checker detect PHP2Shell?
Yes, through the declared PHP version. PHP2Shell is a vulnerability in the PHP engine, not in a package: the preview flags a branch with no fix, and the report reminds you of the minimum version to install on the server. All about PHP2Shell.
Can I check several projects?
Yes, one file at a time: each upload sends its own report. To monitor all your projects every night without uploading files, connect them to LibWatch.
Why do I need to give an email address to get the report?
The report compares each package with every known vulnerability, which takes a little longer than a preview. It goes out within minutes. If you don't tick the box, you only receive this report. If you do, one click in the email activates 14-day monitoring: without that click, we only email you once more, the next day.