PHP

The PHP analyser is triggered when a “composer.json” or “composer.lock” is found in the root of the project.

When operating on a PHP project the analyser will directly load the dependencies from the lock file. If a “composer.json” is found but not the lock, this will be generated using “composer install”.

When using the thin client, the required tools may have to be installed and configured (composer). This is not required when using the dockerized client.

The scanner works on:

• standard PHP packages from packagist.org

• Bower and NPM packages repackaged as native Composer packages from asset-packagist.org

• Drupal packages from drupal.org