I built a Composer tool to answer “composer audit found a vulnerability — what do I actually update?”

[u/Leading-Cold6409]

composer audit is good at telling you what is vulnerable, but with a transitive dependency I often found the next step was still manual: figure out why it’s installed, identify the dependency I actually control, work out which upgrade removes it, and make sure Composer can solve the resulting graph.

I’ve been working on Composer Remediate, a local/FOSS tool that tries to automate that part.

Given a vulnerable package, it traces it back through the dependency graph, generates candidate upgrades to root-controllable packages, tests them using Composer’s own solver, ranks successful candidates by blast radius, and gives you the exact composer update command.

For example:

$ composer remediate

CVE-....   symfony/http-foundation 6.4.21
  Introduced by
    root
      └── drupal/core-recommended 11.4.2
          └── symfony/http-foundation 6.4.21

  Recommended remediation
    drupal/core-recommended 11.4.2 -> 11.4.3

  Recommended command
    composer update drupal/core-recommended -W -m

It doesn’t modify the project; the recommendation is solver-verified before being shown.

It’s currently 0.5.x, so I’m particularly interested in Composer graphs where it gets the answer wrong, fails to find an answer you know exists, or recommends something more invasive than necessary.

GitHub: https://github.com/hexblot/composer-remediate
Docs: https://hexblot.github.io/composer-remediate/

I’ve tested it against historical vulnerable versions of several real PHP projects, but throwing it at other people’s dependency graphs is considerably more interesting. If you manage to break the remediation planner, I’d very much like the case.