🎯 GetSecurityAdvisoriesForPackages

Fetches security advisories for a given batch of packages (grouped by package name).

When to use

🎯 When you already know a project's direct dependency list and only care about vulnerabilities in those packages; 🚀 in a CI pipeline, batch-validate dependency security after composer install; 🔎 for ad-hoc investigation targeting a specific vendor.

Signature

func (c *ComposerClient) GetSecurityAdvisoriesForPackages(packageNames []string) (*domain.AdvisoriesResponse, error)

Parameters

Parameter	Type	Description
packageNames	[]string	List of package names, e.g. []string{"symfony/http-foundation", "guzzlehttp/guzzle"}

Return value

Value	Type	Description
Result	*domain.AdvisoriesResponse	Advisories is a map[package name][]*Advisory, containing only the requested packages
Error	error	Returned on HTTP failure, non-200 status, or JSON parse failure

Corresponding endpoint: GET https://packagist.org/api/security-advisories/?packages[]={pkg}&packages[]={pkg}.

Example

package main

import (
	"fmt"
	"log"
	"time"

	"github.com/scagogogo/composer-skills/pkg/client"
)

func main() {
	c := client.NewComposerClient(30 * time.Second)

	resp, err := c.GetSecurityAdvisoriesForPackages([]string{
		"symfony/http-foundation",
		"guzzlehttp/guzzle",
	})
	if err != nil {
		log.Fatal(err)
	}
	for pkg, advisories := range resp.Advisories {
		fmt.Printf("%s: %d advisories\n", pkg, len(advisories))
		for _, a := range advisories {
			fmt.Printf("  - %s affects versions %s\n", a.Title, a.AffectedVersions)
		}
	}
}

Advanced

• 🔒 To fetch all advisories, use GetSecurityAdvisories.
• ⏱️ For incremental sync by time, use GetSecurityAdvisoriesSince.
• 📦 To get the full set of package names first, use ListPackages and then filter.