SecurityAdvisories
Deptrac
Our great sponsors
| SecurityAdvisories | Deptrac | |
|---|---|---|
| 6 | 16 | |
| 2,644 | 2,552 | |
| 0.9% | 2.0% | |
| 9.6 | 6.2 | |
| 8 days ago | 13 days ago | |
| PHP | ||
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
SecurityAdvisories
-
Preventing Installing Composer Dependencies with Known Security Vulnerabilities
To reduce the chance of introducing vulnerable dependencies into your projects, you can use tools such as "Roave Security Advisories" (roave/security-advisories).
- With the recent scandal over the 'node-ipc' package, is Composer also vulnerable like this? Is there any security measure in the Composer to prevent this type of attack?
- Open source is not a place for politics
-
Composer conflict, how can we use it?
In order to avoid accepting third-party code with well-known security issues you can take advantage of SecurityAdvisories by Roave, a library which uses conflict as shown in this article to block unsafe packages. Give it a look!
-
PHP libraries and tools
roave/security-advisories: Security advisories as a simple composer exclusion list, updated daily
-
Laravel QR Code Generator Infected with Malware
Every composer user should use at least https://github.com/Roave/SecurityAdvisories
Deptrac
- Microservices aren't the problem. Incompetent people are
-
Enforce architecture rules with Deptrac
Deptrac
-
PHP libraries and tools
Deptrac: Keep your architecture clean.
-
Enforcing module boundaries in a large php app
So far I've found some tools which I could piece together to accomplish enforcing module boundaries, probably run as part of an automated github action. - https://github.com/qossmic/deptrac Uses YAML to define any boundary, you can also use @internal to hide implementation classes. Seems like a good way to achieve what I want.
- Deptrac - architectural code analysis
- Deptrac - architectural static code analysis
- Deptrac, the is a static code analysis tool to enforce architectural decisions had version 1.0.0 released!
-
Best way to check custom coding conventions
How about https://qossmic.github.io/deptrac/ ?
-
The use of `class` for things that should be simple free functions (2020)
>I wonder: Is automatic DI even helpful? You save some lines of boilerplate but sacrifice control over the initialization-order and get a flat, messy, implicit dependency graph
Initialization order doesn't matter if your services are stateless. At least in our codebase, all of them are stateless, as it greatly simplifies reasoning about concurrent code (both in-process and between servers). Yes, it's easy to end up with a very a convoluted dependency graph under the hood, but I don't think it's a problem you really should care about. I mean, your code most likely already compiles to a very convoluted mess of machine code under the hood (with all the optimizations, ABI quirks etc.) and I doubt it matters to you much, as long as it does its job well and doesn't hinder your productivity.
If you are talking about messy dependency graphs from the architectural standpoint (someone can easily add a dependency in the constructor without thinking about the consequences), we use deptrac for our PHP monolith which can validate your architecture is clean at build time [0]
However, for our microservices written in Go, we decided to use manual DI to stimulate developers to prefer simpler design, otherwise our microservices could quickly turn to monoliths again.
[0] https://github.com/qossmic/deptrac
-
The 4 basic libraries every Symfony Project needs to improve code quality
Deptrac is a static code analysis tool for PHP that helps you communicate, visualize and enforce architectural decisions in your projects.
What are some alternatives?
local-php-security-checker - PHP security vulnerabilities checker
PHP Architecture Tester - PHP Architecture Tester - Easy to use architectural testing tool for PHP :heavy_check_mark:
enlightn - Your performance & security consultant, an artisan command away.
modular-laravel - Modular Laravel - Boilerplate project starter
PHPStan - PHP Static Analysis Tool - discover bugs in your code without running it!
phpstan-rules - 👓 Provides a composer package with rules for phpstan/phpstan.
ruby-advisory-db - A database of vulnerable Ruby Gems
phpstan-magento - Magento specific extension for PHPStan
Serializer - Library for (de-)serializing data of any complexity (supports JSON, and XML)
phparch
GrumPHP - A PHP code-quality tool