composer audit used Composer version

[glaubinix]

Now that Composer can audit a lock file, it would be helpful if Composer could check if the currently used Composer version is affected by any security advisories. This should make it more obvious to users in case they use a Composer version that has security issues.

Not quite sure whether this should happen as part of the regular composer audit functionality or whether this should happen in some other place.

[Seldaek]

Should be doable as part of audit command for sure, I don't know if I would otherwise do it on every run, probably rather not.

[stof]

To me, it would be better if composer audit stayed focused on auditing the project itself and not the composer phar (as the way to fix it is totally different). We might have a composer self-audit to audit the composer.lock of the phar itself.

[stof]

Doing a self audit as part of composer diagnose might make sense though.

[malcomio]

If the project includes any dependencies on composer/composer, you may think that this feature is already in place, although it is auditing the version in the project's vendor directory, rather than the version actually being used when you run composer.

When I run composer audit in a project where the lock file includes

            "name": "composer/composer",
            "version": "2.6.3",

then I get the following output:

composer audit
The new audit.abandoned setting (currently defaulting to "report" will default to "fail" in Composer 2.7, make sure to set it to "report" or "ignore" explicitly by then if you do not want this.
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| CVE               | CVE-2023-43655                                                                   |
| Title             | Composer Remote Code Execution vulnerability via web-accessible composer.phar    |
| URL               | https://github.com/advisories/GHSA-jm6m-4632-36hf                                |
| Affected versions | >=2.3.0,<2.6.4|>=2.0.0,<2.2.22|<1.10.27                                          |
| Reported at       | 2023-09-29T20:39:21+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Local dev developer@doc

The behaviour is slightly confusing, because if I run composer -V I see that I'm using version 2.6.5 - audit must be checking the version in vendor

[Seldaek]

@malcomio yes indeed it checks the one in vendor as audit looks at the vendor dir only. So it still is good to report it in that case IMO. But anyway requiring composer is generally not a great idea, and something I discourage unless you have no other choice.

[Seldaek]

See #11761

[malcomio]

Thanks - https://github.com/drupal/core-dev includes composer/composer as a dependency.

I've created https://www.drupal.org/project/drupal/issues/3412268 on that project with a link to this.