本文目录导读：
对于PHP项目的依赖漏洞管理，Dependabot是一个非常实用的工具,我来详细介绍如何使用Dependabot来管理和修复PHP项目的依赖漏洞。
Dependabot 配置指南
基础配置
在项目根目录创建 .github/dependabot.yml 文件：
version: 2
updates:
# 配置 Composer 依赖更新
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
timezone: "Asia/Shanghai"
# 限制更新数量
open-pull-requests-limit: 10
# 版本更新策略
versioning-strategy: increase
# 指定依赖类型
labels:
- "dependencies"
- "composer"
# 忽略某些依赖
ignore:
- dependency-name: "phpunit/phpunit"
versions: [">=9.x"]
# 创建更新PR时的审查者
reviewers:
- "team-lead"
# 指定更新类型
update-types:
- "version-update:semver-patch"
- "version-update:semver-minor"
安全更新配置
专门针对安全漏洞的配置：
version: 2
updates:
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "daily" # 安全更新建议每天检查
# 只处理安全更新
open-pull-requests-limit: 5
# 自动合并安全更新（谨慎使用）
auto-merge:
- match:
dependency-type: "production"
update-type: "semver-patch"
# 安全更新的优先级
labels:
- "security"
- "priority-high"
PHP常见依赖漏洞类型
常见的漏洞包示例
{
"require": {
"laravel/framework": "8.x",
"guzzlehttp/guzzle": "7.x",
"monolog/monolog": "2.x"
}
}
漏洞检测命令
# 使用 Composer 检查安全漏洞 composer audit # 安装本地安全审计工具 composer require --dev enlightn/security-checker # 运行安全检查 php vendor/bin/security-checker security:check composer.lock # 使用 Roave Security Advisories composer require --dev roave/security-advisories:dev-master
自动修复策略
版本约束更新
{
"require": {
"symfony/http-foundation": "^5.4 || ^6.0",
"guzzlehttp/guzzle": "^7.4.5",
"league/flysystem": "^1.1.10 || ^2.3.0 || ^3.0.0"
}
}
PHPStan 配合使用
创建 phpstan.neon 配置：
parameters:
level: max
paths:
- src
checkMissingIterableValueType: true
checkGenericClassInNonGenericObjectType: true
工作流程集成
GitHub Actions 工作流
# .github/workflows/dependency-check.yml
name: Dependency Security Check
on:
schedule:
- cron: '0 6 * * 1' # 每周一早上6点
pull_request:
paths:
- 'composer.json'
- 'composer.lock'
jobs:
security-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.1'
tools: composer:v2
- name: Check for security vulnerabilities
run: |
composer audit --format=json > audit-report.json
- name: Upload audit report
uses: actions/upload-artifact@v3
with:
name: security-audit-report
path: audit-report.json
- name: Fail on critical vulnerabilities
run: |
if grep -q "critical" audit-report.json; then
echo "Critical vulnerabilities found!"
exit 1
fi
最佳实践
依赖管理策略
{
"require": {
"php": "^8.1",
"laravel/framework": "^10.0",
"spatie/laravel-permission": "^5.10"
},
"require-dev": {
"phpunit/phpunit": "^10.0",
"mockery/mockery": "^1.5",
"nunomaduro/collision": "^7.0"
}
}
composer.json 安全配置
{
"config": {
"platform": {
"php": "8.1.12"
},
"preferred-install": "dist",
"sort-packages": true,
"optimize-autoloader": true,
"allow-plugins": {
"composer/package-versions-deprecated": true,
"dealerdirect/phpcodesniffer-composer-installer": true
}
},
"scripts": {
"post-update-cmd": [
"@composer audit"
],
"security-check": [
"composer audit --format=json > security-report.json",
"vendor/bin/security-checker security:check"
]
}
}
本地预检查
创建 pre-commit 钩子：
#!/bin/bash
# .git/hooks/pre-commit
# 检查 composer.lock 变更时的安全漏洞
if git diff --cached --name-only | grep -q "composer.lock"; then
echo "检查 composer.lock 的安全漏洞..."
composer audit 2>&1 | tee /dev/stderr
if [ $? -ne 0 ]; then
echo "存在安全漏洞，请先修复"
exit 1
fi
fi
升级策略示例
渐进式升级
# dependabot.yml 的分组配置
version: 2
updates:
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "weekly"
# 分组更新
groups:
laravel:
patterns:
- "laravel/*"
update-types:
- "minor"
- "patch"
dev-dependencies:
patterns:
- "*"
dependency-type: "development"
自动合并条件
# 设置自动合并规则
version: 2
updates:
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "daily"
allow:
- dependency-type: "direct"
update-type: "semver-patch"
# 自动合并条件
auto-merge:
- match:
dependency-type: "production"
update-type: "semver-patch"
- match:
dependency-type: "development"
update-type: ["semver-patch", "semver-minor"]
监控与报告
定期安全报告生成
#!/bin/bash # scripts/security-report.sh # 生成依赖清单 composer show --format=json > dependency-list.json # 运行安全检查 composer audit --format=json > vulnerability-report.json # 生成HTML报告 echo '<!DOCTYPE html> <html><head><title>Security Report</title></head><body> <h1>PHP Dependency Security Report</h1> <pre>' > report.html cat vulnerability-report.json >> report.html echo '</pre></body></html>' >> report.html
提醒与通知
# .github/workflows/dependabot-notify.yml
name: Dependabot Notifications
on:
pull_request:
types: [opened, reopened]
branches: [main]
jobs:
notify:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- name: Check if security update
id: check
run: |
if echo "${{ github.event.pull_request.title }}" | grep -i "security"; then
echo "is_security=true" >> $GITHUB_OUTPUT
fi
- name: Notify team
if: steps.check.outputs.is_security == 'true'
run: |
echo "安全更新需要人工审核"
# 可以集成 Slack/邮件通知
这样配置后，Dependabot 就能自动检测 PHP 项目的依赖漏洞，创建修复 PR，并提供完整的安全审计流程，记得定期检查和更新依赖,保持项目安全性。
