psalm
Analyze PHP code for type and security issues
Changes since last week
1 resolved.
Resolved advisories (1)
- M
GHSA-5wxr-w449-57cminshivammathur/setup-php@v2
Known vulnerabilities
No known advisories matched the declared dependencies.
Not counted: 1 match (action reference to a moving tag or branch). Neither identifies a version installed from a registry.
Second opinion: OSV-Scanner
OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.
Release integrity
Verdict: no Linux binary.
- Checksums file: no
- Signatures: yes
- SLSA provenance: no
- SBOM published with the release: no
Verified means a signature, provenance, or attestation was checked against an identity in vimeo/psalm's own GitHub Actions workflows.
Repository security (OpenSSF Scorecard)
Score 4.7/10, assessed 2026-10-19 (OpenSSF public dataset). Scorecard viewer
All checks
| Check | Score | Reason |
|---|---|---|
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Code-Review | 0 | Found 0/5 approved changesets -- score normalized to 0 |
| Fuzzing | 0 | project is not fuzzed |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
| Security-Policy | 0 | security policy file not detected |
| Signed-Releases | 8 | 5 out of the last 5 releases have a total of 5 signed artifacts. |
| Binary-Artifacts | 10 | no binaries found in the repo |
| License | 10 | license file detected |
| Maintained | 10 | 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
| Branch-Protection | — | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| Dangerous-Workflow | — | no workflows found |
| Packaging | — | packaging workflow not detected |
| Pinned-Dependencies | — | no dependencies found |
| Token-Permissions | — | No tokens found |
GitHub Actions workflow audit (zizmor)
5 potential issues in 13 workflow files at this release: 1 high, 3 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.
All findings
| Severity | Rule | Location | Note |
|---|---|---|---|
| High | dangerous-triggers use of fundamentally insecure workflow trigger | .github/workflows/perf-comment.yml:6 | this workflow |
| Medium | excessive-permissions overly broad permissions | .github/workflows/bcc.yml:5 | this job |
| Medium | template-injection code injection via template expansion | .github/workflows/build-stubs.yml:97 | this step |
| Medium | excessive-permissions overly broad permissions | .github/workflows/pr-labels.yml:6 | this job |
| Informational | superfluous-actions action functionality is already included by the runner | .github/workflows/build-phar.yml:86 | this step |
Dependencies (68)
By ecosystem: composer 57, github 11.
Licenses (as declared in the SBOM): MIT 52, unknown 11, BSD-3-Clause 4, Apache-2.0 1.
composer (57)
| Name | Version | License | Declared in |
|---|---|---|---|
amphp/amp | v3.1.0 | MIT | vendor-bin/box/composer.lock |
amphp/byte-stream | v2.1.1 | MIT | vendor-bin/box/composer.lock |
amphp/cache | v2.0.1 | MIT | vendor-bin/box/composer.lock |
amphp/dns | v2.4.0 | MIT | vendor-bin/box/composer.lock |
amphp/parallel | v2.3.1 | MIT | vendor-bin/box/composer.lock |
amphp/parser | v1.1.1 | MIT | vendor-bin/box/composer.lock |
amphp/pipeline | v1.2.2 | MIT | vendor-bin/box/composer.lock |
amphp/process | v2.0.3 | MIT | vendor-bin/box/composer.lock |
amphp/serialization | v1.0.0 | MIT | vendor-bin/box/composer.lock |
amphp/socket | v2.3.1 | MIT | vendor-bin/box/composer.lock |
amphp/sync | v2.3.0 | MIT | vendor-bin/box/composer.lock |
composer/pcre | 3.3.2 | MIT | vendor-bin/box/composer.lock |
composer/semver | 3.4.3 | MIT | vendor-bin/box/composer.lock |
composer/xdebug-handler | 3.0.5 | MIT | vendor-bin/box/composer.lock |
daverandom/libdns | v2.1.0 | MIT | vendor-bin/box/composer.lock |
doctrine/deprecations | 1.1.4 | MIT | vendor-bin/box/composer.lock |
fidry/console | 0.6.11 | MIT | vendor-bin/box/composer.lock |
fidry/filesystem | 1.2.3 | BSD-3-Clause | vendor-bin/box/composer.lock |
humbug/box | 4.6.3 | MIT | vendor-bin/box/composer.lock |
humbug/php-scoper | 0.18.17 | MIT | vendor-bin/box/composer.lock |
jetbrains/phpstorm-stubs | v2024.3 | Apache-2.0 | vendor-bin/box/composer.lock |
justinrainbow/json-schema | 5.3.0 | MIT | vendor-bin/box/composer.lock |
kelunik/certificate | v1.1.3 | MIT | vendor-bin/box/composer.lock |
league/uri | 7.5.1 | MIT | vendor-bin/box/composer.lock |
league/uri-interfaces | 7.5.0 | MIT | vendor-bin/box/composer.lock |
nikic/iter | v2.4.1 | BSD-3-Clause | vendor-bin/box/composer.lock |
nikic/php-parser | v5.4.0 | BSD-3-Clause | vendor-bin/box/composer.lock |
phpdocumentor/reflection-common | 2.2.0 | MIT | vendor-bin/box/composer.lock |
phpdocumentor/reflection-docblock | 5.6.1 | MIT | vendor-bin/box/composer.lock |
phpdocumentor/type-resolver | 1.10.0 | MIT | vendor-bin/box/composer.lock |
phpstan/phpdoc-parser | 2.1.0 | MIT | vendor-bin/box/composer.lock |
psr/container | 2.0.2 | MIT | vendor-bin/box/composer.lock |
psr/event-dispatcher | 1.0.0 | MIT | vendor-bin/box/composer.lock |
psr/http-factory | 1.1.0 | MIT | vendor-bin/box/composer.lock |
psr/http-message | 2.0 | MIT | vendor-bin/box/composer.lock |
psr/log | 3.0.2 | MIT | vendor-bin/box/composer.lock |
revolt/event-loop | v1.0.7 | MIT | vendor-bin/box/composer.lock |
sebastian/diff | 5.1.1 | BSD-3-Clause | vendor-bin/box/composer.lock |
seld/jsonlint | 1.11.0 | MIT | vendor-bin/box/composer.lock |
seld/phar-utils | 1.2.1 | MIT | vendor-bin/box/composer.lock |
symfony/console | v7.2.1 | MIT | vendor-bin/box/composer.lock |
symfony/deprecation-contracts | v3.5.1 | MIT | vendor-bin/box/composer.lock |
symfony/event-dispatcher-contracts | v3.5.1 | MIT | vendor-bin/box/composer.lock |
symfony/filesystem | v7.2.0 | MIT | vendor-bin/box/composer.lock |
symfony/finder | v7.2.2 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-ctype | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-iconv | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-intl-grapheme | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-intl-normalizer | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-mbstring | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/polyfill-php84 | v1.31.0 | MIT | vendor-bin/box/composer.lock |
symfony/process | v7.2.0 | MIT | vendor-bin/box/composer.lock |
symfony/service-contracts | v3.5.1 | MIT | vendor-bin/box/composer.lock |
symfony/string | v7.2.0 | MIT | vendor-bin/box/composer.lock |
symfony/var-dumper | v7.2.3 | MIT | vendor-bin/box/composer.lock |
thecodingmachine/safe | v3.0.0 | MIT | vendor-bin/box/composer.lock |
webmozart/assert | 1.11.0 | MIT | vendor-bin/box/composer.lock |
github (11)
| Name | Version | License | Declared in |
|---|---|---|---|
actions/cache | v5 | .github/workflows/bcc.yml | |
actions/checkout | v6 | .github/workflows/announce-release.yml | |
actions/download-artifact | v8.0.2 | .github/workflows/perf-comment.yml | |
actions/upload-artifact | v7.0.1 | .github/workflows/build-stubs.yml | |
actions/upload-artifact | v7.0.2 | .github/workflows/perf.yml | |
docker/setup-buildx-action | v4 | .github/workflows/build-docker.yml | |
fkirc/skip-duplicate-actions | v5.3.2 | .github/workflows/build-docker.yml | |
mheap/github-action-required-labels | v5 | .github/workflows/pr-labels.yml | |
shivammathur/setup-php | v2 | .github/workflows/announce-release.yml | |
shivammathur/setup-php | v2.40.0 | .github/workflows/macos-scan.yml | |
svenstaro/upload-release-action | v2 | .github/workflows/build-phar.yml |
History
| Week | Version | Dependencies | Critical | High | Medium | Low | Unknown | Changes |
|---|---|---|---|---|---|---|---|---|
| 2026-11-02 | 6.20.5 | 68 | 0 | 0 | 0 | 0 | 0 | 1 resolved |
| 2026-11-01 | 6.20.5 | 68 | 0 | 0 | 1 | 0 | 0 | — |
SBOM minimum elements
Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.
| Standard | Score | Checks passed | Failed checks |
|---|---|---|---|
| NTIA 2021 | 71 | 5/7 | Supplier Name, Dependency Relationship |
| CISA 2025 | 50 | 5/10 | Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author |
| BSI TR-03183 | 44 | 4/9 | Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact |
Evidence
Downloads for this week: CycloneDX SBOM · Grype report
Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/vimeo__psalm/.
18 manifests and lockfiles scanned
.github/workflows/announce-release.yml, .github/workflows/auto-release.yml, .github/workflows/bcc.yml, .github/workflows/build-docker.yml, .github/workflows/build-phar.yml, .github/workflows/build-stubs.yml, .github/workflows/ci.yml, .github/workflows/macos-scan.yml, .github/workflows/perf-comment.yml, .github/workflows/perf.yml, .github/workflows/pr-labels.yml, .github/workflows/shepherd.yml, .github/workflows/windows-ci.yml, assets/psalm-phar/composer.json, composer.json, vendor-bin/bcc/composer.json, vendor-bin/box/composer.json, vendor-bin/box/composer.lock
Full JSON for this project · Atom feed of weekly changes
Badges
shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.
[](https://rezmoss.github.io/awesome-security-pipeline/projects/vimeo/psalm/index.html)How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |