Magento 2 Composer Dashboard by Corrivate

Introduction

This module provides a dashboard inside the Magento admin to view your composer packages;

• What packages are installed? Are they up to date?
• Are there any security advisories for these packages?

Under the hood it uses Composer to fetch the data, but it exposes that data in a way that's friendlier for merchants, project managers etc. to review.

[image: Dashboard with security advisories]
[image: Dashboard with installed packages]

Additionally, you can:

• Configure email addresses to receive a daily/weekly reminder about security advisories against your installed packages.
• Configure email addresses to receive a daily/weekly reminder about directly installed packages in need of upgrading.
• Use the Magento API to check up on package status (for example, from an agency dashboard).

[image: Reminder email about security advisories]
[image: Reminder email about outdated packages]

Installation

Installation is straightforward. In your local dev environment you can run:

composer require corrivate/magento2-composer-dashboard
bin/magento setup:upgrade

This should add the following to your app/etc/config.php:

'Corrivate_ComposerDashboard' => 1,
'Loki_CssUtils' => 1,
'Loki_Base' => 1,
'Loki_Components' => 1,
'Loki_AdminComponents' => 1,

Permissions

If your admin users have customized roles, you may need to grant them permission to use the Composer Dashboard under System > User Roles.

Loki Admin Components

As you can see, we depend on Loki Admin Components under the hood to present the dashboard. Writing this package was a good test project to see how much easier Loki makes it to write admin functionality compared to the classic Magento UI components. (Turns out, a lot.)

Usage

In the admin, you can find the dashboard under the System > Composer Dashboard heading.

Security Advisories

This uses composer audit under the hood to retrieve advisories for installed packages.

Installed Packages

This uses composer show to gather information about all your installed (non-dev) packages.

Note that the latest version reported here is the latest version you have access to. It's possible that for some (private/third party) packages there are newer versions that you don't have access to, for example because you'd need to renew your subscription. Unfortunately there's no universal way to check that through Composer.

Configuring reminder emails

In your Stores > Configuration > Advanced > Composer Dashboard tab, you can configure which email addresses should receive reminders about packages that need attention.

API endpoints

This module also provides API endpoints (again, gated by the same ACL permission) to enable centralized dependency monitoring:

• GET /V1/composerDashboard/audit
• GET /V1/composerDashboard/installed

Note that you must opt in to these API endpoints in the module configuration.

Advanced

Package aliases

Some vendors use commercial names for packages that are quite different than their composer names for those packages. To make this easier to read you can provide an alias through di.xml:

    <type name="Corrivate\ComposerDashboard\Model\Composer\PackageAliases">
        <arguments>
            <argument name="aliases" xsi:type="array">
                <item name="amasty/shopby" xsi:type="string">Improved Layered Navigation</item>
            </argument>
        </arguments>
    </type>

Corrivate

(en.wiktionary.org)

Etymology

From Latin corrivatus, past participle of corrivare ("to corrivate").

Verb

corrivate (third-person singular simple present corrivates, present participle corrivating, simple past and past participle corrivated)

(obsolete) To cause to flow together, as water drawn from several streams.

Changelog

0.7.0

Fixed

• Hardened against composer failures and timeouts (@Maksold)
• Fix CRLF causing getIgnoredAdvisories to fail (@Maksold)
• ACL now enforced (@Maksold)
• Various smaller fixes (@Maksold)
• Removed some manual classes (@jissereitsma)

Added

• SECURITY.md
• Added --ignore-platform-req=php so that you can see more possible upgrades

0.6.2

Fixed

• PHPStan level 8
• __('') that broke bin/magento i18n:collect-phrases
• Change docblocks in interfaces that broke SOAP wsdl

Added

• PHP 8.1 compatibility
• Add config to enable/disable cache warming with cron.

0.6.1

Fixed

• Handle null latest_release_date in composer output.
• Don't send reminder emails if all reportable packages were ignored.

0.6.0

Added

• You can now ignore packages in reminder emails, for example if Magento is stuck on an old version.

Updated

• Compatible with loki/magento2-admin-components 0.6.x

0.5.1

Updated

• Compatible with loki/magento2-admin-components 0.5.x

0.5.0

Added

• Configuration to enable/disable API access
• Configuration to decide reminder email frequency

Changed

• Using the API no longer bypasses the composer dashboard cache

Fixed

• Filtering the grids now works (newer version of Loki Admin Components).

0.4.2

Fixed

• Fix incorrect field used for filter on installed packages grid

0.4.1

Fixed

• Removed broken-link logo from emails

0.4.0

Added

• API endpoints to enable central monitoring of installed packages & advisories

0.3.1

Fixed

• Github friendly README.md header

0.3.0

Added

• Setup script to initially enable the cache

0.2.0

Added

• Added filtering to security advisory grid
• Can configure daily warning emails about security advisories and weekly emails about possible updates

Fixed

• CVEs and update status are now sortable by priority instead of alphabetical
• Better handling of composer results with empty fields

0.1.2

Fixed

• composer.json typo

0.1.1

Fixed

• composer.json autoload glitches

Added

• README badges

0.1.0

Initial release