Debricked currently supports tracking PHP dependencies installed via the Composer dependency manager, using the composer.json files or composer.lock files.
We recommend committing the composer.lock file, as it contains resolved versions of your direct and indirect dependencies, which results in more accurate scan results.
The composer.lock file is generated whenever one of the following is run:
composer install
composer required
composer update
If at least one of the supported files is committed to your repository, it will be automatically scanned for dependencies when you have done any of our integrations to your CI/CD pipeline.
Supported file formats and features:
| Language | Package Manager | Supported File Formats | Root dependencies | Indirect dependencies | Dependency trees | Security Scanning | License Scanning | Root Fix |
| PHP | Composer | composer.json | ✓ | ✓ | ✓ | ✓ | ✓ | |
| composer.lock | ✓ | ✓ | ✓ | ✓ | ✓ |
Have a look at the overview of all supported languages.