🔒 GetSecurityAdvisories

Fetches all known security advisories on Packagist (grouped by package name).

When to use

🔒 When building a PSIRT / vulnerability intelligence database and periodically pulling the full set of known advisories; 🛡️ loading the full advisory set once at startup as a local cache, then keeping it fresh with the incremental endpoint; 📋 generating organization-level dependency security reports.

Signature

func (c *ComposerClient) GetSecurityAdvisories() (*domain.AdvisoriesResponse, error)

Parameters

This method takes no parameters.

Return value

Value	Type	Description
Result	*domain.AdvisoriesResponse	Advisories is a map[package name][]*Advisory, including CVE, affected versions, links, etc.
Error	error	Returned on HTTP failure, non-200 status, or JSON parse failure

Corresponding endpoint: GET https://packagist.org/api/security-advisories/?updatedSince=0.

Example

package main

import (
	"fmt"
	"log"
	"time"

	"github.com/scagogogo/composer-skills/pkg/client"
)

func main() {
	c := client.NewComposerClient(30 * time.Second)

	resp, err := c.GetSecurityAdvisories()
	if err != nil {
		log.Fatal(err)
	}
	for pkg, advisories := range resp.Advisories {
		fmt.Printf("Package %s has %d advisories\n", pkg, len(advisories))
		for _, a := range advisories {
			fmt.Printf("  - %s: %s (CVE=%s)\n", a.AdvisoryID, a.Title, a.Cve)
		}
	}
}

Advanced

Endpoint change

The old /advisories.json endpoint has been deprecated by Packagist (returns 404). This method uses /api/security-advisories/ instead and passes updatedSince=0 to retrieve all advisories — this endpoint requires at least one query parameter, otherwise it returns 400.

• 🎯 To query only certain packages, use GetSecurityAdvisoriesForPackages.
• ⏱️ For incremental sync, use GetSecurityAdvisoriesSince.