search

Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.72k stars 106 forks source link

Document that `composer update --dry-run roave/security-advisories` is equivalent to checking locked dependencies #59

Closed Ocramius closed 5 years ago

Ocramius commented 5 years ago

Also worth investigating if composer require --dry-run --dev roave/security-advisories would work.

This work should be reflected in README.md

azjezz commented 5 years ago

Also worth investigating if composer require --dry-run --dev roave/security-advisories would work.

there's no dry-run option in the require command

Ocramius commented 5 years ago

@azjezz maybe something worth adding upstream?

alcohol commented 5 years ago

require is basically a shortcut for programatically updating your composer.json file with the new requirement (and some magic that determines a constraint if not given), and then running update. So passing the --dry-run from require on to the update command should be feasible I think. But you'd also have to reverse the change to the composer.json file afterwards, and that makes it more tricky. I think an RFC for this would probably be accepted though (submitting a PR would help a lot in that regard :+1:).

azjezz commented 5 years ago

@Ocramius https://github.com/azjezz/composer/commit/a85d64c48f52506908154882503b3acdbcf12d95 :)

alcohol commented 5 years ago

@azjezz the only (minor) flaw with that is that you hide the output also in case of an error during the dry-run attempt.

Ocramius commented 5 years ago

Closing here, handled by @GeeH in #60

azjezz commented 5 years ago

@alcohol huh, will check later, thanks :)