Free tool, no account
Check your composer.lock for end-of-life dates and known advisories
Drop the file below. In a few seconds you see when your PHP version and framework stop getting fixes, which installed versions have known security advisories, and which packages are abandoned.
Lock Check runs in your browser and needs JavaScript. If it doesn't appear, reload the page, or send us your composer.lock and we'll look at it for you.
What the check reads
The check reads your composer.lock and, if you add it, your composer.json. From them it works out:
- PHP: the version set in the Composer files, when it stops getting fixes, and the highest PHP version your locked packages allow. If they rule out the next version, it names the packages in the way.
- Framework: Laravel, Symfony, Laminas and Zend Framework, CodeIgniter and CakePHP, with their end-of-support dates.
- Security advisories: known advisories from Packagist for the installed versions, each with a link to its source and where the fix is: a newer release of the same branch (
composer update), only a newer major version, or no fix published. - Abandoned packages: flagged in the lock file or on Packagist.
At the top of the report, one sentence and a risk level for someone who doesn't read lock files. "Copy summary" gives you plain text without package names, for a ticket or an email to your manager.
On our test lock files (Laravel 5.8, Laravel 12, Symfony 4.4 and Zend Framework 1) the advisories match composer audit one to one.
What a lock file can't show: your code, PHP extensions and the server, how the app is deployed and tested, and who still knows it. That is where a Debt Check starts.
Privacy and the data behind the check
Is my composer.lock uploaded?
No. The file is read in this browser tab, and nothing on this page uploads it. You can watch the Network tab of your browser's developer tools while the check runs.
What does my browser send, and where to?
To check advisories and abandoned packages, your browser asks packagist.org directly:
- package names (for example
symfony/console) for the advisories, - vendor names (for example
symfony) for the abandoned flags.
Versions are not sent; they are compared in the tab. The requests carry no cookies and no page address. Like any website, packagist.org sees your IP address and this site's domain.
End-of-life dates ship with the page. Only if that file can't be loaded does your browser ask endoflife.date for the dates of PHP, Laravel, Symfony and CakePHP.
Can I run it without sending anything?
Yes. Tick "Offline check" and nothing goes to packagist.org or endoflife.date. You still get the end-of-life dates and the abandoned flags stored in the lock file, but no advisories. "Try with a sample" sends nothing either. The page remembers the offline setting in your browser's local storage, on your device only.
Does Refberg see my results?
No. The report is built in your browser, and we receive no file, no package names and no result. This site keeps no visitor statistics. If you follow a link from the report to the contact form, the address shows only that you came from Lock Check and the risk level. Details in the privacy policy.
How is this different from composer audit?
composer audit lists advisories for your installed packages, from the same Packagist data. Lock Check adds the end-of-life dates for PHP and the framework, the highest PHP version your packages allow, where each fix is, and a summary someone outside the team can read. It runs without installing anything.
Does a high risk level mean the app has been hacked?
No. It means support has ended, or some advisories have no fix in the branch you use. An advisory in the list means the installed version is in the affected range. Whether your code uses the affected part, the lock file can't show.
How current are the dates and advisories?
Advisories come from Packagist at the moment you run the check. End-of-life dates ship with the page, from endoflife.date and the Zend Framework, Laminas and CodeIgniter project pages; the report shows the date of the data. Our EOL calendar is checked against the maintainers' own pages.