⚠️ HasVulnerabilities

Quickly determines whether the current project has any known security vulnerabilities and returns a boolean. Internally calls AuditWithJSON and checks the Found count.

When to use

Use this in CI gates, pre-deployment checks, or health checks when you only need a boolean "has vulnerabilities or not" conclusion. This method is fault-tolerant toward Composer's non-zero exit code when vulnerabilities are found: as long as the error message contains the words Found and vulnerabilities, it is also treated as having vulnerabilities.

Signature

func (c *Composer) HasVulnerabilities() (bool, error)

Parameters

This method takes no parameters.

Return value

Return value	Type	Description
First return value	bool	true indicates vulnerabilities exist, false indicates none found
Second return value	error	Returned when an error (unrelated to vulnerabilities) occurs during the check

Note

Finding vulnerabilities is not returned as an error — this is the key difference between this method and calling Audit directly.

Example

package main

import (
	"fmt"
	"log"

	"github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
	comp, err := composer.NewComposer("")
	if err != nil {
		log.Fatalf("Initialization failed: %v", err)
	}

	hasVulns, err := comp.HasVulnerabilities()
	if err != nil {
		log.Fatalf("Failed to check vulnerabilities: %v", err)
	}

	if hasVulns {
		fmt.Println("Warning: security vulnerabilities exist in the project!")
	} else {
		fmt.Println("No security vulnerabilities found in the project.")
	}
}

Advanced

• For vulnerability details: use AuditWithJSON or GetAuditInfo.
• To focus only on high-severity vulnerabilities: use GetHighSeverityVulnerabilities.
• To check for abandoned packages: use GetAbandonedPackages.