PHPackages                             innobrain/composer-fix - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. innobrain/composer-fix

ActiveComposer-plugin[Security](/categories/security)

innobrain/composer-fix
======================

Fixes security vulnerabilities reported by composer audit by updating the affected packages.

v1.0.0(3w ago)214↓50%MITPHPPHP ^8.1

Since Jun 18Pushed 1w agoCompare

[ Source](https://github.com/innobraingmbh/composer-fix)[ Packagist](https://packagist.org/packages/innobrain/composer-fix)[ RSS](/packages/innobrain-composer-fix/feed)WikiDiscussions main Synced 2w ago

READMEChangelog (4)Dependencies (6)Versions (3)Used By (0)

[![Latest Version on Packagist](https://camo.githubusercontent.com/823a7488e176a65782d3ccece2294a8e73b0e24119bc70f261263b3e33613fbf/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f696e6e6f627261696e2f636f6d706f7365722d6669782e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/innobrain/composer-fix)[![Total Downloads](https://camo.githubusercontent.com/cbdc5da33f04fa3d2d92c1eddea6b7eff66491649eeba0e58715ffb5ba267cd2/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f696e6e6f627261696e2f636f6d706f7365722d6669782e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/innobrain/composer-fix)

composer-fix
============

[](#composer-fix)

A Composer plugin that fixes known vulnerabilities like `npm audit fix`: it audits installed packages and updates the ones with published advisories to a version that is no longer affected.

Installation
------------

[](#installation)

Install it globally so `composer fix` is available in every project:

```
composer global require innobrain/composer-fix
```

Composer will ask to allow the plugin the first time — confirm, or add it to `allow-plugins` in your global `composer.json`. Registers a single command, `composer fix`.

Usage
-----

[](#usage)

```
composer fix
```

Audits installed packages against your repositories' advisories (Packagist by default) and runs a targeted `composer update` on the affected ones, staying within your existing `composer.json` constraints.

Packages without a reachable fix are skipped — kept off the update list — so one unfixable package (an EOL major, a fix only published in the next major) cannot fail the whole solve under Composer's advisory policy and throw away the fixes that are reachable. Each skip is reported with its reason:

- `out-of-range` — the safe version is outside the root constraint; `--force` can bump it.
- `transitive` — the constraints of installed dependents exclude the safe version; update the dependents or require the package directly.
- `held-back` — a pool filter (e.g. soak-time) hides the safe version.
- `dev-only` — only a branch head escapes the advisory. A dev build is never treated as a fix: on an EOL major with `minimum-stability: dev` the solver would otherwise land on e.g. `10.x-dev`, which only hides the advisory.
- `unfixable` — no published version escapes the advisory.

After updating, any package whose `php` requirement exceeds the project's php floor (`config.platform.php`, or the lower bound of `require.php`) is reported as a warning — the lock may not install on the oldest php the project claims to support. This never fails the run.

If `vendor/` is not installed (e.g. a fresh clone), the audit falls back to `composer.lock`, like `composer audit --locked`. With neither `vendor/` nor a lock file there is nothing to audit, so the command errors with exit `1` — `--no-fail` does not cover this case.

Exits `0` when every advisory is resolved and `1` when packages remain vulnerable after the update, so CI pipelines fail on unfixed advisories. Pass `--no-fail` to exit `0` in that case too — useful when a wrapper treats any non-zero exit as a failed run and would discard the fixes that did land.

Requires Composer 2.9 or newer.

### Bumping constraints (`--force`)

[](#bumping-constraints---force)

```
composer fix --force
```

Rewrites affected root constraints to the *lowest* safe version before updating — the smallest bump that removes the vulnerability, like `npm audit fix --force`. **Can introduce breaking changes**, so review the `composer.json` diff. The constraint is patch-level (e.g. `^5.4.20`) so it also excludes the vulnerable lower versions.

### Dry run

[](#dry-run)

```
composer fix --dry-run
```

Shows the plan without touching `composer.json`, the lock file, or `vendor/`.

### Machine-readable output (`--json`)

[](#machine-readable-output---json)

```
composer fix --json
```

Moves all human-readable messages to stderr and prints a JSON document as the **last line of stdout** (update scripts such as `artisan package:discover` may write to stdout before it, so parse the last line):

```
{
  "advisories": [{"package": "...", "installed": "...", "severity": "high", "advisories": [{"title": "...", "cve": "...", "link": "..."}]}],
  "planned": ["packages/passed-to-the-updater"],
  "bumped": [{"package": "...", "requireKey": "require", "from": "^1.0", "to": "^2.1.1", "safeVersion": "2.1.1"}],
  "skipped": [{"package": "...", "reason": "out-of-range", "safeVersion": "2.1.1"}],
  "updated": [{"package": "...", "from": "1.5.0", "to": "1.8.2"}],
  "stillVulnerable": [{"package": "...", "installed": "1.8.0"}],
  "platformWarnings": [{"package": "...", "requiresPhp": ">=8.2", "platformPhp": "^8.1 (require.php)"}]
}
```

`stillVulnerable` is `null` when the post-update state is unknown (dry run or a failed update). The exit code keeps its usual meaning.

### Options

[](#options)

OptionDescription`--force`Bump constraints when the safe version is out of range.`--dry-run`Preview the plan without changing anything.`--no-dev`Ignore `require-dev` packages in the audit. Never installs or removes dev packages either way — vendor keeps its current dev/no-dev state.`-w`, `--with-dependencies`Also update dependencies of affected packages (except root requirements).`-W`, `--with-all-dependencies`Also update dependencies of affected packages, including root requirements.`--ignore-unreachable`Ignore repositories that are unreachable or return a non-200.`--no-fail`Exit `0` even when packages remain vulnerable after the update.`--json`Print a machine-readable result as the last line of stdout; messages move to stderr.Pool-filtering plugins (e.g. soak-time)
---------------------------------------

[](#pool-filtering-plugins-eg-soak-time)

`composer fix` never picks a version another plugin would refuse to install. Both the update and `--force` selection go through Composer's normal pool creation (`PRE_POOL_CREATE`), so a plugin that prunes the pool — such as [soak-time](https://github.com/innobrain/soak-time) — also prunes what `composer fix` considers. If the only safe version is held back, `--force`reports it and leaves `composer.json` unchanged instead of bumping to a version that won't resolve.

How it works
------------

[](#how-it-works)

1. Match installed packages against advisories via Composer's advisory API.
2. Split the affected packages into fixable and skipped: a package is fixable when a safe, non-dev version survives the pool build and fits the root constraint plus the constraints of installed dependents (which stay locked during a targeted update).
3. With `--force`, resolve the lowest safe version of each affected root requirement and rewrite its constraint.
4. Run a targeted `composer update` on the fixable packages only.
5. Re-audit, warn about packages requiring php above the project floor, and report anything still vulnerable.

Development
-----------

[](#development)

```
composer install
composer test
```

License
-------

[](#license)

MIT

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance96

Actively maintained with recent releases

Popularity11

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~19 days

Total

2

Last Release

26d ago

Major Versions

v0.1.0 → v1.0.02026-07-07

### Community

Maintainers

![](https://www.gravatar.com/avatar/beb1d357716423ec46cf7e3ff0827574b0e17a095bc2cd7b218bf5955056be9b?d=identicon)[innobrain](/maintainers/innobrain)

---

Top Contributors

[![kauffinger](https://avatars.githubusercontent.com/u/62616071?v=4)](https://github.com/kauffinger "kauffinger (13 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/innobrain-composer-fix/health.svg)

```
[![Health](https://phpackages.com/badges/innobrain-composer-fix/health.svg)](https://phpackages.com/packages/innobrain-composer-fix)
```

###  Alternatives

[phpro/grumphp

A composer plugin that enables source code quality checks.

4.3k17.0M1.1k](/packages/phpro-grumphp)[drupal/core-composer-scaffold

A flexible Composer project scaffold builder.

5345.4M590](/packages/drupal-core-composer-scaffold)[drupal/core-vendor-hardening

Hardens the vendor directory for when it's in the docroot.

175.0M53](/packages/drupal-core-vendor-hardening)[drupal/core-project-message

Adds a message after Composer installation.

2125.4M211](/packages/drupal-core-project-message)[phpro/grumphp-shim

GrumPHP Phar distribution

294.9M346](/packages/phpro-grumphp-shim)[altis/core

Core module for Altis

19233.0k4](/packages/altis-core)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)