✅ Validate

Validate the format, schema, and consistency of composer.json and composer.lock, and check constraints such as security vulnerabilities and platform prohibitions.

Composer's validate command is the entry point for dependency governance. Composer Skills breaks it into a set of semantic methods: from the basic Validate, to strict mode, skipping specific checks, schema-only validation, lock sync checks, and the structured ValidateStructured. Each method corresponds to a "check granularity", avoiding hand-stitching command-line arguments in scripts.

When to Use

• ✅ Pre-commit local validation: whether composer.json conforms to the schema and fields are complete.
• 📦 Pre-publish checks: whether Packagist publishing requirements are met (the inverse of --no-check-publish).
• 🔄 CI sync checks: whether composer.lock is in sync with composer.json and properly formatted.
• 🛡️ Security integration: CheckForSecurityVulnerabilities returns "output + whether there are vulnerabilities" in a single call.
• 🧩 Platform constraint inspection: Prohibit shows which packages are prohibited from installation by the current platform requirements.

Structured Return Types

ValidateResult

Returned by ValidateStructured / ParseValidateOutput.

type ValidateResult struct {
    Valid    bool     `json:"valid"`
    Errors   []string `json:"errors,omitempty"`
    Warnings []string `json:"warnings,omitempty"`
}

Field	Type	Description
Valid	bool	Whether validation passes overall
Errors	[]string	List of error messages (presence means Valid=false)
Warnings	[]string	List of warning messages (does not affect Valid)

Parsing Logic

ParseValidateOutput scans the output line by line: lines containing error/Error go into Errors and set Valid=false; lines containing warning/Warning go into Warnings. ValidateStructured also forces Valid=false when the command returns a non-zero exit code.

---

Validate

✅ Validate that composer.json is valid (convenience form with no return value).

Signature

func (c *Composer) Validate() error

Parameters

None.

Return Values

Value	Type	Description
Error	error	Returns an error when validation fails; nil means passed

Definition Location

This method is defined in config.go; its signature differs from the other methods in validate.go that return (string, error) — it only cares about "whether it passed" and does not return output text. To get the output, use ValidateStructured or the ValidateXxx methods below.

Example

if err := comp.Validate(); err != nil {
    log.Fatalf("composer.json validation failed: %v", err)
}
fmt.Println("composer.json validation passed")

---

ValidateStrict

✅ Validate composer.json in strict mode.

Signature

func (c *Composer) ValidateStrict() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Output of composer validate --strict
Error	error	Returned when validation fails

Equivalent Command

composer validate --strict

Example

output, err := comp.ValidateStrict()
if err != nil {
    log.Fatalf("Strict validation failed: %v", err)
}
fmt.Println("Validation result:", output)

---

ValidateWithNoCheck

✅ Validate composer.json but do not check all platform requirements and other constraints.

Signature

func (c *Composer) ValidateWithNoCheck() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Validation output
Error	error	Returned when validation fails

Equivalent Command

composer validate --no-check-all

Example

output, err := comp.ValidateWithNoCheck()
if err != nil {
    log.Fatalf("Validation failed: %v", err)
}
fmt.Println("Format-only validation result:", output)

---

ValidateWithCheckVersion

✅ Validate composer.json and check dependency version constraints (including transitive dependencies).

Signature

func (c *Composer) ValidateWithCheckVersion() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Validation output
Error	error	Returned when validation fails

Equivalent Command

composer validate --with-dependencies

Example

output, err := comp.ValidateWithCheckVersion()
if err != nil {
    log.Fatalf("Version constraint validation failed: %v", err)
}
fmt.Println("Version constraint validation result:", output)

---

ValidateSchema

✅ Only validate that composer.json and composer.lock conform to the JSON schema, without checking other constraints.

Signature

func (c *Composer) ValidateSchema() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Validation output
Error	error	Returned when validation fails

Equivalent Command

composer validate --no-check-all --no-check-publish --no-check-version

Example

output, err := comp.ValidateSchema()
if err != nil {
    log.Fatalf("Schema validation failed: %v", err)
}
fmt.Println("Schema validation result:", output)

---

NormalizeComposerJson

✅ Format composer.json to conform to the canonical format.

Signature

func (c *Composer) NormalizeComposerJson() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Output of the normalize command
Error	error	Returned when formatting fails

Equivalent Command

composer normalize (requires the ergebnis/composer-normalize plugin)

Example

output, err := comp.NormalizeComposerJson()
if err != nil {
    if strings.Contains(err.Error(), "command not found") {
        fmt.Println("Please install the normalize plugin first: composer global require ergebnis/composer-normalize")
    } else {
        log.Fatalf("Formatting failed: %v", err)
    }
}
fmt.Println("Formatting result:", output)

Depends on External Plugin

normalize is not a built-in Composer command; without the plugin installed it reports "command not found". You can pair it with CheckNormalization to first detect whether formatting is needed.

---

ValidateComposerLock

✅ Validate that composer.lock exists and is in sync with composer.json.

Signature

func (c *Composer) ValidateComposerLock() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Validation output
Error	error	Returned when validation fails

Equivalent Command

composer validate --check-lock

Example

output, err := comp.ValidateComposerLock()
if err != nil {
    if strings.Contains(output, "not found") {
        fmt.Println("Missing composer.lock file")
    } else if strings.Contains(output, "not up to date") {
        fmt.Println("composer.lock needs updating, please run composer update")
    } else {
        log.Fatalf("Failed to validate composer.lock: %v", err)
    }
} else {
    fmt.Println("composer.lock is valid:", output)
}

---

Prohibit

✅ Show packages prohibited by the current platform requirements.

Signature

func (c *Composer) Prohibit() (string, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	List of prohibited packages
Error	error	Returned when the query fails

Equivalent Command

composer prohibit

Example

output, err := comp.Prohibit()
if err != nil {
    log.Fatalf("Failed to query prohibited packages: %v", err)
}
fmt.Println("Prohibited packages:", output)

Advanced Variants

• ProhibitWithFormat(format string) (string, error): equivalent to composer prohibit --format=format, where format can be text or json.
• ProhibitWithOptions(options map[string]string) (string, error): custom option combination, e.g., specifying both format=json and fixed.

// JSON format + full path
options := map[string]string{
    "format": "json",
    "fixed":  "",
}
output, err := comp.ProhibitWithOptions(options)

---

CheckForSecurityVulnerabilities

✅ Check whether the project dependencies have known security vulnerabilities, returning an "output + whether there are vulnerabilities" triple.

Signature

func (c *Composer) CheckForSecurityVulnerabilities() (string, bool, error)

Parameters

None.

Return Values

Value	Type	Description
Output	string	Raw output of composer audit
Has vulnerabilities	bool	true means vulnerabilities were detected
Error	error	Returned when an unexpected error occurs during the check

Implementation Notes

Runs composer audit. Composer returns a non-zero exit code when it finds vulnerabilities; this method analyzes the output: if it contains keywords like Found + vulnerability/vulnerabilities or Security vulnerability, it considers there to be vulnerabilities and returns (output, true, nil), not surfacing the exit code as an error. Other genuine execution errors are returned as error.

Example

output, hasVulnerabilities, err := comp.CheckForSecurityVulnerabilities()
if err != nil {
    log.Fatalf("Security check failed: %v", err)
}
if hasVulnerabilities {
    fmt.Println("Warning: security vulnerabilities found!")
    fmt.Println(output)
} else {
    fmt.Println("No security vulnerabilities found")
}

Difference from HasVulnerabilities

Security Audit - HasVulnerabilities returns (bool, error) and internally goes through the JSON parsing path for greater accuracy; this method returns the raw text output + a boolean, suitable for scenarios where you also need the output text for log archiving.

---

Advanced

ValidateStructured

Structured validation, returns *ValidateResult, making it easy to programmatically inspect errors and warnings.

func (c *Composer) ValidateStructured() (*ValidateResult, error)

Value	Type	Description
Result	*ValidateResult	Contains Valid/Errors/Warnings
Error	error	Execution error (note: a failed validation does not necessarily produce an error — check the Valid field)

result, err := comp.ValidateStructured()
if err != nil {
    log.Fatalf("Validation failed: %v", err)
}
if !result.Valid {
    for _, e := range result.Errors {
        fmt.Println("Error:", e)
    }
}
for _, w := range result.Warnings {
    fmt.Println("Warning:", w)
}

ValidateWithOptions

Combine multiple validation flags, equivalent to composer validate <flags>.

func (c *Composer) ValidateWithOptions(options map[string]string) (string, error)

// Strict validation and check dependencies
options := map[string]string{
    "strict":            "",
    "with-dependencies": "",
}
output, err := comp.ValidateWithOptions(options)

ParseValidateOutput

A pure function that parses any composer validate text output into *ValidateResult, useful for post-processing old output from caches or logs.

func ParseValidateOutput(output string) *ValidateResult

Other Validation-Related Methods

Method	Equivalent Command	Description
ValidateWithNoCheckPublish()	validate --no-check-publish	Don't check fields required for publishing to Packagist
ValidateQuiet()	validate --quiet	Quiet validation, only outputs on error
CheckNormalization()	validate --no-check-all --check-normalized	Check whether composer.json is canonically formatted
CheckPlatformReqsLock()	check-platform-reqs --lock	Check platform requirements in composer.lock
CheckForOutdatedPackages(direct, minor, format)	outdated [--direct] [--minor-only] [--format F]	Check for outdated packages, see table below

CheckForOutdatedPackages Parameters

Parameter	Type	Description
direct	bool	true to only check direct dependencies
minor	bool	true to only show minor updates
format	string	Output format, e.g., text, json; empty string means unspecified

// Only check minor updates of direct dependencies, output as JSON
output, err := comp.CheckForOutdatedPackages(true, true, "json")

🔍 Related Methods

• Security Audit: structured vulnerability analysis centered on audit.
• Platform: CheckPlatformReqsStructured returns a structured check result of platform requirements.
• Diagnosis & Health Check: HealthCheck internally calls ValidateStructured and writes the result to the Valid field.