🔒 ParseComposerAuditJSON

Parses the JSON output of composer audit --format=json and returns the structured AuditInfoResult (a list of security vulnerability advisories).

When to use

Use this when you already have the JSON output of composer audit and need to programmatically enumerate known security vulnerabilities and handle them by severity. It is the parser called internally by GetAuditInfo.

Signature

func ParseComposerAuditJSON(output string) (*AuditInfoResult, error)

Parameters

Parameter	Type	Description
output	string	The raw output of composer audit --format=json

Return value

• *AuditInfoResult: the audit result; Advisories is []AuditAdvisoryInfo, and Count is automatically set to the number of advisories.
• error: returned when JSON deserialization fails (internally delegates to ParseAuditInfoResult).

Each AuditAdvisoryInfo contains PackageName, Version, Title, Severity (critical/high/medium/low), CVE, Link, and ReportedAt.

Example

package main

import (
	"fmt"
	"log"

	"github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
	output := `{"advisories":[{"package":"monolog/monolog","version":"2.1.0","title":"RCE vulnerability","severity":"high","cve":"CVE-2022-1000"}]}`

	result, err := composer.ParseComposerAuditJSON(output)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Printf("Found %d security vulnerabilities\n", result.Count)
	for _, adv := range result.Advisories {
		fmt.Printf("  %s %s: %s (%s)\n", adv.PackageName, adv.Version, adv.Title, adv.Severity)
	}
}

Advanced

• 🔄 This function is equivalent to ParseAuditInfoResult(output) and auto-fills Count.
• 🚀 To execute the command and parse in one step, use GetAuditInfo(); with options, use GetAuditInfoWithOptions(options). Note: composer audit returns a non-zero exit code when vulnerabilities are found, but the output is still valid JSON; the wrapper methods already handle this.
• ⚠️ There is also a simpler AuditWithJSON() that returns *AuditResult (defined in audit.go) with slightly different field structure; choose as needed.