Snyk for PHP
This page describes how to use Snyk to scan your PHP projects.
In order to scan your dependencies, you must ensure you have first installed the relevant package manager, and that your Project contains the supported manifest files.
In order to build the dependency tree Snyk analyzes the
composer.lockfiles that it finds to identify the dependencies and their versions.
- Ensure you have installed the relevant package manager before you begin using the Snyk CLI.
- Ensure you have included the relevant manifest files supported by Snyk before testing.
There are no unique options for use when running Snyk for PHP.
PHP Projects can be imported from any of the Git services Snyk supports. Once Projects have been imported, Snyk analyzes your Projects based on their supported manifest files.
Once you select a Project for import, Snyk builds the dependency tree based on these manifest files. Both of the following files are required:
If the composer.lock file is not present in the repository, the import will not process the composer.json manifest.
By default Snyk scans your production dependencies. From the Snyk UI you can configure whether to include your development dependencies (
require_dev) in the scan for vulnerabilities.
To update language preferences:
- 1.Log in to your account and navigate to the relevant Group and Organization that you want to manage.
- 2.Select Settings > Languages.
- 3.Select Edit settings for PHP and select Scan dev dependencies to set for your PHP Projects in the specific eOrganization to include both development and production dependencies.
- 4.Select Update settings.
These settings are applied to all newly imported Projects and to all existing projects when they are re-tested..
The following error messages may appear when you are working with PHP Projects:
- composer.json or composer.lock not found in path
- Manifest file not found in path
- Lockfile missing packages property
- Lockfile or manifest file is not a valid JSON