PHPackages                             k2gl/openvex - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. k2gl/openvex

ActiveLibrary[Security](/categories/security)

k2gl/openvex
============

Read, write and canonicalize OpenVEX documents in PHP

1.0.0(1mo ago)04MITPHPPHP >=8.1CI passing

Since Jul 12Pushed 1mo agoCompare

[ Source](https://github.com/k2gl/openvex)[ Packagist](https://packagist.org/packages/k2gl/openvex)[ Docs](https://github.com/k2gl/openvex)[ RSS](/packages/k2gl-openvex/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (4)Versions (2)Used By (0)

k2gl/openvex
============

[](#k2glopenvex)

[![CI](https://camo.githubusercontent.com/63d522ecb018ebd48cf6e84d7bc7ba94dabe8151efa2a44a2d315a7111f33e4a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b32676c2f6f70656e7665782f63692e796d6c3f6272616e63683d6d61696e266c6162656c3d4349266c6f676f3d676974687562)](https://github.com/k2gl/openvex/actions/workflows/ci.yml)[![Latest Stable Version](https://camo.githubusercontent.com/5a2f8ed01e2a63b7f9a93415a49b3dad6f352339809b77c465b60456a7bca175/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b32676c2f6f70656e7665783f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/k2gl/openvex)[![Total Downloads](https://camo.githubusercontent.com/a526dd4e061aefcfa44a1a7443222b7e59843e385c72e5ee2ed80b1d943cbc65/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6b32676c2f6f70656e7665783f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/k2gl/openvex)[![PHPStan Level](https://camo.githubusercontent.com/01c58e66f2fafb70c17613ff2b1da3f549aade3a735b076da5cd9e5c04b945a5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230392d3261356561373f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://phpstan.org)[![License](https://camo.githubusercontent.com/6214352e737fee7b40a32282c28965b28a77a2764b4d6a27c581af62ee1f74b7/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6b32676c2f6f70656e7665783f636f6c6f723d79656c6c6f77677265656e)](https://packagist.org/packages/k2gl/openvex)

Read, write and canonicalize [OpenVEX](https://github.com/openvex/spec) documents in PHP.

VEX (Vulnerability Exploitability eXchange) answers the question a scanner can't: a CVE appears in your SBOM, but does it actually affect the shipped artifact? An OpenVEX document records that judgement — `not_affected`, `affected`, `fixed` or `under_investigation`, with a machine-readable reason — so a consumer can suppress the noise with an audit trail.

It gives you:

- **Model** — immutable value objects for the whole spec (documents, statements, vulnerabilities, products and subcomponents) that enforce the status/justification rules on construction, so an invalid statement can't exist.
- **(De)serialization** — `fromJson()` / `toJson()` round-trips real-world documents.
- **Canonical hash & IRI** — the deterministic document `@id`, byte-for-byte compatible with the reference implementation ([`openvex/go-vex`](https://github.com/openvex/go-vex)).

Install
-------

[](#install)

```
composer require k2gl/openvex
```

Requires PHP 8.1+ and `ext-json` (bundled with PHP). No other dependencies.

Usage
-----

[](#usage)

### Author a document

[](#author-a-document)

```
use K2gl\OpenVex\OpenVex;
use K2gl\OpenVex\Status;
use K2gl\OpenVex\Justification;

$json = OpenVex::create(author: 'Acme, Inc.')
    ->statement(
        vulnerability: 'CVE-2024-1234',
        status: Status::NotAffected,
        products: ['pkg:composer/k2gl/dsse@1.3.0'],
        justification: Justification::VulnerableCodeNotInExecutePath,
    )
    ->toJson();
```

A product is any IRI or [package URL](https://github.com/package-url/purl-spec); pass a string for the common case, or a full `Product` (with subcomponents, hashes and other identifiers) when you need it. `build()` returns the `Document` instead of JSON and stamps its canonical `@id`.

### Read and query a document

[](#read-and-query-a-document)

```
use K2gl\OpenVex\Document;
use K2gl\OpenVex\Status;

$document = Document::fromJson($json);

foreach ($document->statementsFor('pkg:composer/k2gl/dsse@1.3.0') as $statement) {
    if ($statement->status === Status::NotAffected) {
        // suppress this CVE for that product, with $statement->justification as the reason
    }
}
```

`statementsFor()` matches an IRI, purl, CPE or hash digest against each statement's products and their subcomponents.

### Canonical identity

[](#canonical-identity)

Two documents with the same impact statements always get the same `@id`, regardless of metadata. That makes documents content-addressable and easy to deduplicate.

```
$document->canonicalHash(); // "8ed99017…" — sha256 over the statements only
$document->generateId();    // "https://openvex.dev/docs/public/vex-8ed99017…"
```

Design
------

[](#design)

- The status rules of the spec (`not_affected` needs a justification or an impact statement, `affected` needs an action statement, and so on) are checked in the `Statement` constructor — parsing an invalid document throws rather than yielding a half-valid object.
- Canonicalization follows go-vex exactly and is verified against its published test vectors. Where go-vex leaves component hash/identifier ordering to Go's random map iteration, this port sorts the keys, which is identical for the single-entry maps that occur in practice and deterministic otherwise.
- Timestamps finer than microseconds (Go emits nanoseconds) are truncated on parse; the canonical hash only uses whole seconds, so a document's identity is unaffected.

License
-------

[](#license)

MIT — see [LICENSE](LICENSE).

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance91

Actively maintained with recent releases

Popularity3

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 66.7% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

50d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6bc4aa529c7f13ea593297497f6eae20d5c07f476baa0a551960d7e6ff1e5413?d=identicon)[k2gl](/maintainers/k2gl)

---

Top Contributors

[![k2gl](https://avatars.githubusercontent.com/u/2846079?v=4)](https://github.com/k2gl "k2gl (2 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (1 commits)")

---

Tags

vexSBOMadvisoryvulnerabilityattestationsupply-chainin-totoopenvexexploitabilityopenssf

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/k2gl-openvex/health.svg)

```
[![Health](https://phpackages.com/badges/k2gl-openvex/health.svg)](https://phpackages.com/packages/k2gl-openvex)
```

###  Alternatives

[psecio/versionscan

A PHP version scanner for reporting possible vulnerabilities

25056.4k1](/packages/psecio-versionscan)[mitnick/laravel-security

laravel-mitnick helps you secure your Laravel apps by setting various HTTP headers. it can help!

8111.8k1](/packages/mitnick-laravel-security)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)