The mcvs-php-action uses osv-scanner
by Google to scan the composer.lock for vulnerabilities. osv-scanner is
actively maintained and provides robust vulnerability scanning using the OSV
(Open Source Vulnerabilities) database.
It complements composer audit,
which uses the Packagist security advisories
database. Both are run by the security-composer-packages testing type, as the
two databases do not fully overlap.
Note: both scanners inspect the composer.lock, so that file has to be
committed. Constraints in the composer.json are not sufficient to determine
whether a resolved version is vulnerable.
Add an osv-scanner.toml file to your project to ignore certain vulnerabilities
that cannot be fixed right away. This allows you to acknowledge known issues while
preventing the CI/CD pipeline from failing.
Create an osv-scanner.toml file in your project root:
# osv-scanner.toml
# Documentation: https://google.github.io/osv-scanner/configuration/
# Ignore specific vulnerabilities
[[IgnoredVulns]]
id = "GHSA-3xq5-wjfh-ppjc"
ignoreUntil = 2026-09-13
reason = "Waiting for upstream fix: https://github.com/some/package/issues/1234"
[[IgnoredVulns]]
id = "CVE-2024-1234"
ignoreUntil = 2026-09-13
reason = "False positive - not applicable to our usage"- Each ignored vulnerability should have a clear
reasonexplaining why it's ignored - Review and update the ignore list regularly
- Ignored vulnerabilities should be temporary - aim to fix or update dependencies