Composer security advisories

No known advisories. On the record.

Qoliber publishes a machine-readable advisory feed covering all 284 extension packages. Add one repository to your composer.json and composer audit gets a real answer about our code — instead of silence.

composer audit --locked

$ composer audit --locked
Downloading https://security.qoliber.com/packages.json
Downloading https://security.qoliber.com/p2/qoliber/gdpr-consent.json
Downloading https://security.qoliber.com/p2/qoliber/seo-suite.json
Downloading https://security.qoliber.com/p2/qoliber/advanced-faq.json
No security vulnerability advisories found.
$ echo $?
0

composer.json

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://security.qoliber.com",
      "only": ["qoliber/*"]
    }
  ]
}

Needs Composer 2.4+. From 2.9+ affected versions stop installing.

The ledger

One mark per package. Every one carries a document stating what we know about it — today, for all of them, that document is empty.

284 clear · 0 with advisories

Hover or focus a mark to see the package.

The gap

Most vendor repositories say nothing

composer audit only knows what a repository tells it. Private repositories almost never publish advisories, so audits pass over vendor code in silence. Silence is not a clean bill of health — it is an absence of information.

What we publish

An empty array is a statement

Each of our 284 packages has a document saying explicitly what is known about it. Right now every one reads []. That is a checked answer, recorded and dated — not a gap where an answer should be.

What it does

It blocks, it doesn't just report

From Composer 2.9 an advisory removes affected versions from the resolver. When we publish one, those versions stop installing — on your machines and in your pipelines — without you having to read an announcement.

Add the repository

One entry. It carries advisories only — your packages keep installing from wherever they install from today.

composer.json

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://security.qoliber.com",
      "only": ["qoliber/*"]
    }
  ]
}

The only filter is not required — the feed already answers for qoliber/* and nothing else — but it makes the intent explicit and keeps Composer from asking us about anyone else's packages.

Composer	What you get
`2.4+`	`composer audit` reports our advisories
`2.9+`	Affected versions are blocked at install and update time
`2.10+`	Audit exits `0` when clean, `1` when anything is found

Report a vulnerability

If you have found something in a Qoliber extension, tell us directly rather than opening a public issue.

[email protected]

Include the package name and version, what you observed, and the steps to reproduce it. A proof of concept helps but is not required to get a reply.

We acknowledge reports, investigate, and — where the issue is real — ship a fix and publish an advisory here naming the affected range. You will be credited unless you would rather not be.

How our advisories work

The feed follows a published specification, and we hold ourselves to two rules beyond it.

QOLIBER-SA-YYYY-NNN: Advisory identifiers are unique and permanent. Nothing de-duplicates advisories across repositories, so an id is never reused or reissued.
low · medium · high · critical: The severity vocabulary Composer's --ignore-severity compares against, so you can filter on it.
Every range is bounded: We always publish a closed range with a fix version, such as >=1.0.0,<1.0.4 — never an open >=1.0.0. An open range would block every release we ever ship afterwards.
Never a partial advisory: Every advisory carries a title, sources and a report date. An advisory missing any of them does not degrade quietly — it makes composer audit abort on your side.

The wire format is the Composer repository security-advisories specification. Our feed is validated against it on every change, before anything is published.