# corrivate/magento2-composer-dashboard

> View composer issues inside the Magento admin panel, useful for PMs etc.

`composer require corrivate/magento2-composer-dashboard`

Canonical URL: https://packagento.com/corrivate/magento2-composer-dashboard

## At a glance

- **Vendor**: corrivate (https://packagento.com/corrivate.md)
- **Latest version**: 0.7.0 — released 2026-07-23
- **Pricing**: Free
- **Package type**: Magento 2 module
- **Status**: active, accepting new buyers

## Installation

Packagento is licence-gated, so even free packages need a licence on a project before Composer can resolve them.

1. **Sign in or create an account** at https://packagento.com/customer/account/.

2. **Add the package to your account.** Open https://packagento.com/corrivate/magento2-composer-dashboard and complete the free checkout. A licence is minted automatically.

3. **Create or pick a project, then activate the licence on it.**
   - Projects represent the Magento installs you deploy to. Manage them at https://packagento.com/projects/.
   - Activate the new licence on the project you'll deploy this package to. Activation is what generates the Composer credentials scoped to that project.

4. **Add the project credentials to your Magento codebase.**

   Grab the project's public + private key from https://packagento.com/projects/ (open the project, then its Credentials tab), and add them to `auth.json`:

   ```json
   {
     "http-basic": {
       "packagento.com": {
         "username": "ppk_live_...",
         "password": "psk_live_..."
       }
     }
   }
   ```

   Add the Packagento Composer repository to `composer.json`:

   ```json
   {
     "repositories": [
       { "type": "composer", "url": "https://packagento.com" }
     ]
   }
   ```

5. **Install and apply.**

   ```bash
   composer require corrivate/magento2-composer-dashboard:*
   bin/magento setup:upgrade
   bin/magento setup:di:compile
   bin/magento cache:flush
   ```

## What it does

View composer issues inside the Magento admin panel, useful for PMs etc.

## README

<table>
  <tr>
    <td><img src="docs/corrivate-128x128.png" alt="Corrivate Logo" width="128" height="128"></td>
    <td>
      <h1>Magento 2 Composer Dashboard</h1>
      <p>by Corrivate</p>
    </td>
  </tr>
</table>

[![Latest Version on Packagist](https://img.shields.io/packagist/v/corrivate/magento2-composer-dashboard?color=blue)](https://packagist.org/packages/corrivate/magento2-composer-dashboard)
[![MIT Licensed](https://img.shields.io/badge/license-MIT-brightgreen.svg)](LICENSE.md)

### Introduction

This module provides a dashboard inside the Magento admin to view your composer packages;
* What packages are installed? Are they up to date?
* Are there any security advisories for these packages?

Under the hood it uses Composer to fetch the data, but it exposes that data in a way that's friendlier for merchants, project managers etc. to review.

![Dashboard with security advisories](docs/advisories-dashboard.png)
![Dashboard with installed packages](docs/installed-dashboard.png)


Additionally, you can:
* Configure email addresses to receive a daily/weekly reminder about security advisories against your installed packages.
* Configure email addresses to receive a daily/weekly reminder about directly installed packages in need of upgrading. 
* Use the Magento API to check up on package status (for example, from an agency dashboard).

![Reminder email about security advisories](docs/advisories-email.png)
![Reminder email about outdated packages](docs/outdated-email.png)

### Installation

Installation is straightforward. In your local dev environment you can run:

```bash
composer require corrivate/magento2-composer-dashboard
bin/magento setup:upgrade
```

This should add the following to your `app/etc/config.php`:
```php
'Corrivate_ComposerDashboard' => 1,
'Loki_CssUtils' => 1,
'Loki_Base' => 1,
'Loki_Components' => 1,
'Loki_AdminComponents' => 1,
```

#### Permissions
If your admin users have customized roles, you may need to grant them permission to use the `Composer Dashboard` under System > User Roles.

#### Loki Admin Components

As you can see, we depend on [Loki Admin Components](https://loki-extensions.com/docs/admin-components) under the hood to present the dashboard. Writing this package was a good test project to see how much easier Loki makes it to write admin functionality compared to the classic Magento UI components. (Turns out, a lot.)

### Usage

In the admin, you can find the dashboard under the System > Composer Dashboard heading.

#### Security Advisories

This uses `composer audit` under the hood to retrieve advisories for installed packages.

#### Installed Packages

This uses `composer show` to gather information about all your installed (non-dev) packages. 

Note that the latest version reported here is the latest version *you have access to*. It's possible that for some (private/third party) packages there are newer versions that you don't have access to, for example because you'd need to renew your subscription. Unfortunately there's no universal way to check that through Composer.

#### Configuring reminder emails

In your Stores > Configuration > Advanced > Composer Dashboard tab, you can configure which email addresses should receive reminders about packages that need attention.

### API endpoints

This module also provides API endpoints (again, gated by the same ACL permission) to enable centralized dependency monitoring:

* GET `/V1/composerDashboard/audit`
* GET `/V1/composerDashboard/installed`

Note that you must opt in to these API endpoints in the module configuration.

### Advanced

#### Package aliases

Some vendors use commercial names for packages that are quite different than their composer names for those packages. To make this easier to read you can provide an alias through `di.xml`:

```xml
    <type name="Corrivate\ComposerDashboard\Model\Composer\PackageAliases">
        <arguments>
            <argument name="aliases" xsi:type="array">
                <item name="amasty/shopby" xsi:type="string">Improved Layered Navigation</item>
            </argument>
        </arguments>
    </type>
```

### Corrivate
(en.wiktionary.org)

Etymology

From Latin *corrivatus*, past participle of *corrivare* ("to corrivate").

#### Verb

**corrivate** (*third-person singular simple present* **corrivates**, *present participle* **corrivating**, *simple past and past participle* **corrivated**)

(*obsolete*) To cause to flow together, as water drawn from several streams.

## Changelog

### 0.7.0
#### Fixed
* Hardened against composer failures and timeouts (@Maksold)
* Fix CRLF causing getIgnoredAdvisories to fail (@Maksold)
* ACL now enforced (@Maksold)
* Various smaller fixes (@Maksold)
* Removed some manual classes (@jissereitsma)

#### Added
* SECURITY.md
* Added --ignore-platform-req=php so that you can see more possible upgrades

### 0.6.2
#### Fixed
* PHPStan level 8
* `__('')` that broke `bin/magento i18n:collect-phrases`
* Change docblocks in interfaces that broke SOAP wsdl
#### Added
* PHP 8.1 compatibility
* Add config to enable/disable cache warming with cron.

### 0.6.1
#### Fixed
* Handle null latest_release_date in composer output.
* Don't send reminder emails if all reportable packages were ignored.

### 0.6.0
#### Added
* You can now ignore packages in reminder emails, for example if Magento is stuck on an old version.
#### Updated
* Compatible with loki/magento2-admin-components 0.6.x


### 0.5.1
#### Updated
* Compatible with loki/magento2-admin-components 0.5.x

### 0.5.0
#### Added
* Configuration to enable/disable API access
* Configuration to decide reminder email frequency
#### Changed
* Using the API no longer bypasses the composer dashboard cache
#### Fixed
* Filtering the grids now works (newer version of Loki Admin Components).

### 0.4.2
#### Fixed
* Fix incorrect field used for filter on installed packages grid

### 0.4.1
#### Fixed
* Removed broken-link logo from emails

### 0.4.0
#### Added
* API endpoints to enable central monitoring of installed packages & advisories

### 0.3.1
#### Fixed
* Github friendly README.md header

### 0.3.0
#### Added
* Setup script to initially enable the cache 

### 0.2.0
#### Added
* Added filtering to security advisory grid
* Can configure daily warning emails about security advisories and weekly emails about possible updates

#### Fixed
* CVEs and update status are now sortable by priority instead of alphabetical
* Better handling of composer results with empty fields 

### 0.1.2
#### Fixed
* composer.json typo


### 0.1.1
#### Fixed
* composer.json autoload glitches
#### Added
* README badges

### 0.1.0
Initial release

## Recent Versions

| Version | Released |
|---|---|
| 0.7.0 | 2026-07-23 |
| 0.6.2 | 2026-05-03 |
| 0.6.1 | 2026-03-10 |
| 0.6.0 | 2026-02-23 |
| 0.5.1 | 2026-01-29 |
| 0.5.0 | 2026-01-12 |
| 0.4.2 | 2026-01-05 |
| 0.4.1 | 2026-01-05 |
| 0.4.0 | 2026-01-05 |
| 0.3.1 | 2026-01-05 |

Showing 10 of 15 versions. Full release history on https://packagento.com/corrivate/magento2-composer-dashboard.

## Dependencies

### Require

| Package | Constraint |
|---|---|
| loki/magento2-admin-components | >=0.4.4 <0.7 |
| php | ^8.1 |

## Quality

Latest release (0.7.0) fails the Packagento QA pipeline. Verdicts below are per-cell (Magento line × PHP version) for the matrixed tools, and run-once for the static / security tiers.


### Compatibility

Each Magento line is installed on its supported PHP versions, then the module is built (DI compile + static-content deploy). Cells show passed / failed / untested; staircase gaps render as `–`.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | Pass | Pass | – | – |
| 2.4.8 | – | Pass | Pass | – |
| 2.4.9 | – | – | Pass | Pass |


### Code Quality

Advisory checks against the module's source. Never affect the Compatibility verdict — a phpcs finding can't make a module incompatible.

#### Static Analysis

Coding standards (phpcs), mess detection (phpmd), copy-pasted code (cpd), PHP cross-version compatibility, composer.json validity. Each runs once for the whole module.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| PHPCS | Fail | 37 | 7 errors, 30 warnings (ruleset: Magento2), 22 auto-fixable with phpcbf |
| PHPMD | Pass | 0 |  |
| Cpd | Pass | 0 |  |
| Composer validate | Info | 1 | valid; 1 advisory note (composer validate --strict) |

#### PHPStan

Type-checks the module against a real Magento install. Re-runs per Magento + PHP version because resolvable symbols differ between releases.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | Pass | Pass | – | – |
| 2.4.8 | – | Pass | Pass | – |
| 2.4.9 | – | – | Pass | Pass |


### Tests

Unit and integration suites run per Magento + PHP cell. Test failures speak to the module's behaviour, not its compatibility with a line, so they're reported here separately.

#### Unit Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | – | – |
| 2.4.8 | – | N/A | N/A | – |
| 2.4.9 | – | – | N/A | N/A |

#### Integration Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | – | – |
| 2.4.8 | – | N/A | N/A | – |
| 2.4.9 | – | – | N/A | N/A |


### Security

Dependency-advisory audit (composer audit) plus a source malware scan. A malware detection fails the version outright.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| Composer audit | Pass | 0 |  |
| Malware scan | Pass | 0 |  |

## Licence and pricing

Free. A licence is still minted on checkout and bound to your project for Composer access — no payment step.

Refundable within 14 days of first purchase via https://packagento.com/account/refunds/.

## Install via Claude Code or any MCP client

The Packagento MCP server can run the licence + project + Composer steps above in one tool call:

```
purchase_and_install_packages(
  composer_names=["corrivate/magento2-composer-dashboard"],
  project_id="proj_xxx"
)
```

This handles cart, checkout, licence minting, project activation, and writes auth.json credentials. Connect a client with `claude mcp add packagento https://mcp.packagento.com`. Full setup at https://packagento.com/docs/mcp-setup.

## Vendor

corrivate is a Magento 2 vendor on Packagento. See https://packagento.com/corrivate.md for their full catalogue.