PHPackages depman/client - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. depman/client ActiveLibrary depman/client ============= Reports installed Composer dependencies to DepMan from a post-install hook. v0.1.1(today)04↑2900%MITPHPPHP ^8.1 Since Aug 27Pushed todayCompare [ Source](https://github.com/cool-studio/depman-client-composer)[ Packagist](https://packagist.org/packages/depman/client)[ RSS](/packages/depman-client/feed)WikiDiscussions main Synced today READMEChangelogDependencies (3)Versions (3)Used By (0) depman/client ============= [](#depmanclient) > **This repository is a read-only mirror.**The client is developed in [`cool-studio/depman`](https://github.com/cool-studio/depman) under `packages/composer-client`, and split out here so that Composer can install it. **Open issues and pull requests there** — this repository is force-pushed from the monorepo and anything committed directly is overwritten without warning. Reports the Composer packages **actually installed** in a project to [DepMan](https://depman.io), which matches them against published security advisories and raises a Finding when one of your environments is running a vulnerable version. It runs from your `post-install-cmd` hook, so the inventory stays true without anyone remembering to update it. Each transitive package is reported with the route back to the dependency **you** declared, so an advisory against something you have never heard of still names the line in your `composer.json`that pulls it in. The routes come from `vendor/composer/installed.json` — what the installer actually wrote, not what the lockfile intended — and where they cannot be worked out the client sends nothing rather than a guess. It will not break your build ---------------------------- [](#it-will-not-break-your-build) That is the rule the rest of the design follows from. The hook catches every throwable and returns normally; a missing config file, a missing token, an unreachable server, a rate limit and a timeout are all ordinary states rather than failures; and the process exits `0` unless you explicitly ask otherwise with `--fail-on-error`. A dependency-inventory tool that fails installs gets removed, and then it protects nobody. It also has **zero runtime dependencies**. This package installs into your production tree, so anything it required would become part of your supply chain. Install ------- [](#install) ``` composer require depman/client vendor/bin/depman install-hook # patches composer.json for you ``` Configure --------- [](#configure) `depman.json` lives in your project root and **is committed**, so it holds no secrets — the client refuses a `token` key loudly and carries on without it. ``` { "$schema": "https://schema.depman.io/depman.schema.v1.json", "configVersion": 1, "endpoint": "https://depman.acme-internal.com", "project": "acme/storefront", "environment": { "from": ["DEPMAN_ENV", "APP_ENV"], "fallback": "local", // a laptop is not production "map": { "prod": "production", "stage": "staging" }, "allowed": ["local", "ci", "staging", "production"] }, "ecosystems": "auto", "include": { "dev": true, "optional": true }, "failOnError": false, // never break composer install "timeoutMs": 10000, "offline": { "mode": "spool", "spoolDir": ".depman/spool" }, "logLevel": "warn" } ``` Your DepMan instance's onboarding wizard renders this file with your project's real values already filled in. Every setting can be overridden per-run: the project `.env` is read first, then the process environment, then `depman.json`, then the built-in default. **A missing `depman.json` is a silent skip.** It means this project does not use DepMan. The token --------- [](#the-token) `DEPMAN_TOKEN`, found in the first of these that has it: 1. `DEPMAN_TOKEN` in the project's `.env` — where a developer puts their secrets, and where the hook can still read it, because your application framework has not booted during an install. 2. `DEPMAN_TOKEN` in the process environment — CI. 3. `DEPMAN_TOKEN_FILE` pointing at a file — Docker and Kubernetes secret mounts. 4. `~/.depman/credentials`, JSON keyed by endpoint host. The value is never printed and never written to a payload or a log line. **No token at all is a skip, not an error** — a contributor who has just cloned your repository gets nothing but silence. Commands -------- [](#commands) CommandDoes`vendor/bin/depman report`Report the installed tree now`vendor/bin/depman doctor`Print the resolved config, the environment **and where it came from**, and which mechanism supplied the token — never the value`vendor/bin/depman install-hook`Wire the post-install hook into `composer.json``doctor` is the first thing to run when a project is not reporting: ``` Project: acme/storefront Endpoint: https://depman.acme-internal.com Environment: production (from APP_ENV) Token: found via .env Include dev: yes ``` Requirements ------------ [](#requirements) PHP 8.1 or newer. Composer 2. Development ----------- [](#development) This package is self-contained: clone it on its own, and its whole toolchain is here. ``` composer install composer check # pint --test, phpstan, phpunit ``` Changes belong in the [monorepo](https://github.com/cool-studio/depman), not here. License ------- [](#license) MIT. ### Health Score 37 — LowBetter than 81% of packages Maintenance100 Actively maintained with recent releases Popularity5 Limited adoption so far Community6 Small or concentrated contributor base Maturity33 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 0d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/ec4b2f97a2fd8f4a742e995c5de3c7ea7b8e04cbeef35d205264b7f04a3a4bdf?d=identicon)[J4Wx](/maintainers/J4Wx) --- Top Contributors [![J4Wx](https://avatars.githubusercontent.com/u/3397311?v=4)](https://github.com/J4Wx "J4Wx (11 commits)") ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StyleLaravel Pint Type Coverage Yes ### Embed Badge ![Health badge](/badges/depman-client/health.svg) ``` [![Health](https://phpackages.com/badges/depman-client/health.svg)](https://phpackages.com/packages/depman-client) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)