PHP composerのパッケージ脆弱性チェック

2022年05月01日追記

Trivy による脆弱性スキャン

Trivyを使うのが良いでしょう🐱

$ wget https://get.symfony.com/cli/installer -O - | bash
$ /Users/yuu3/.symfony/bin/symfony security:check --dir=/Users/yuu3/Desktop/develop.nosync/xxx_project/composer.lock

Symfony Security Check Report
=============================

1 package has known vulnerabilities.

laravel/framework (v5.x.xx)
---------------------------

 * [CVE-NONE-0001][]: RCE vulnerability in "cookie" session driver

[CVE-NONE-0001]: https://blog.laravel.com/laravel-cookie-security-releases

Note that this checker can only detect vulnerabilities that are referenced in the security advisories database.
Execute this command regularly to check the newly discovered vulnerabilities.