Composer Guide to Supply Chain Security
summary
Concrete, actionable points: commit composer.lock and run composer install in CI, never run updates during deploy; never vendor dependencies — vendoring breaks updates and hides deletions; use a private Composer registry (Private Packagist or similar) so metadata and code are preserved; Composer 2.4 adds composer audit for known vulnerabilities; allow-plugins (since 2.2) limits runtime plugin execution; real incidents (SolarWinds, Log4j, event-stream, left-pad) show social and supply-chain attacks and prove these measures matter.
AI-written summary · about
chapters (12)
- 0:00Supply chain security intro
- 4:18Why supply chain security matters
- 10:44Real-world supply chain attacks
- 15:57Funding open source maintenance
- 19:26Composer supply chain tips
- 22:36How Composer manages deps
- 26:51Vendoring dependencies risks
- 30:46Private Composer repositories
- 32:35Safe deployment with lock files
- 34:20Monitoring dependencies
- 37:28Composer plugins and security
- 39:14Q&A
