PHP

Jump to bottom

github-actions[bot] edited this page Aug 4, 2026 · 2 revisions

PHP (Composer)

Part of the ecosystems matrix.

Lockfile

composer.lock - the packages (and packages-dev) arrays. Names are vendor/package.

Graph

Built from the lock; Composer vendors dependencies under vendor/ when installed, so a committed vendor tree is also covered by scan.

Online resolution

Registry: packagist.org/packages/<vendor>/<package>.json → the package.repository field.

Gotcha

Platform packages (php, ext-*, lib-*) aren't real Composer packages and are skipped.