Provides information if your SilverStripe application uses dependencies with known vulnerabilities.
BSD 3-clause License
- SilverStripe Framework ^4
- SilverStripe QueuedJobs ^4
This module will automatically amend the SiteSummary report provided by the SilverStripe Maintenance module, adding alerts if security updates are present for installed modules.
The following installation commands includes schedulding a queuedjob to populate the data. Run the following command to install this package as a development dependency:
composer require bringyourownideas/silverstripe-composer-security-checker 2.x-dev vendor/bin/sake dev/build vendor/bin/sake dev/tasks/ProcessJobQueueTask
The information gets updated via a BuildTask, which in turn can be run via a queuedjob.
You will need to set up a scheduled process (e.g.
cron) to run either the buildtask directly, or the task to process the queuedjobs queue in order to refresh the information.
Use the information is stored in the
SecurityAlert object, and can be consumed as needed. Please be careful how you expose this information. If the SilverStripe Maintenance module is present, a relationship will be connected between
Please see the user guide section of the SilverStripe Maintenance module.