🛡️ CheckForSecurityVulnerabilities

Checks whether the current project's dependencies contain known security vulnerabilities, equivalent to running composer audit and automatically analyzing the output. Returns three values: the raw output, whether vulnerabilities exist, and an error.

When to use

Use when you need to quickly determine "do the current dependencies have vulnerabilities" in CI or scheduled patrol checks and trigger alerts based on that. Compared to the plain text output of Audit, this method directly returns a boolean verdict, which is convenient for conditional branching.

Signature

func (c *Composer) CheckForSecurityVulnerabilities() (string, bool, error)

Parameters

This method takes no parameters.

Return value

Return value	Type	Description
First return value	string	Raw output of composer audit
Second return value	bool	true indicates vulnerabilities were detected
Third return value	error	Returned for non-vulnerability errors; nil when vulnerabilities are found

Implementation detail

composer audit returns a non-zero exit code when vulnerabilities are found. This method distinguishes "expected vulnerability notices" from "real execution errors" by analyzing the output text (including keywords such as Found and vulnerability), so it does not return an error when vulnerabilities are found.

Example

package main

import (
	"fmt"
	"log"

	"github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
	comp, err := composer.New(composer.DefaultOptions())
	if err != nil {
		log.Fatalf("init failed: %v", err)
	}

	output, hasVuln, err := comp.CheckForSecurityVulnerabilities()
	if err != nil {
		log.Fatalf("security check failed: %v", err)
	}

	if hasVuln {
		fmt.Println("⚠️ Security vulnerabilities found:")
		fmt.Println(output)
	} else {
		fmt.Println("No security vulnerabilities found")
	}
}

Advanced

• For structured vulnerability details (package name, version, severity, link), use AuditWithJSON.
• To only determine whether vulnerabilities exist, use HasVulnerabilities.
• To get a list of high-severity vulnerabilities, use GetHighSeverityVulnerabilities.