If a security vulnerability is known in Contao or in one of the installed packages and has been closed in a new version, you will receive an email notification from us (if you have activated this in Profile > Settings > Notifications). Within trakked, an additional label "Security risk" appears, with which you can find all affected installations. Furthermore, you can recognise by the red trakked logo that there is a security problem with this installation.
If you then open the detailed view of an installation, a new tab "Security" appears. Here you can see the affected packages and a short description of the security gap. If available, you can find out more details by clicking on the link button.

Ignore certain security vulnerabilities

Imagine you have an installation and a bundle is installed in it that has recently been affected by a security vulnerability. Unfortunately, it is a bundle that you use in practically every installation. To close the security vulnerability, you would have to reference a new version of this bundle. However, since an update is not possible at this time and you know that this security vulnerability does not pose a threat to your installation, you find the constant reminders from trakked in the weekly notification and display in the app annoying. Composer offers the option of ignoring certain security vulnerabilities via an entry in the composer.json. This is used in composer audit, and we naturally take these entries into account as well.

Let us take the following two security vulnerabilities as examples:

Then your entry in composer.json should look like this:

{
    "config": {
        "policy": {
            "advisories": {
                "ignore-id": ["PKSA-qv5y-crcz-9nxw"]
            }
        }
    }
}

Of course, you can also document the reason for yourself:

{
    "config": {
        "policy": {
            "advisories": {
                "ignore-id": {
                    "PKSA-qv5y-crcz-9nxw": "The affected component is not in use."
                }
            }
        }
    }
}

If there are multiple security vulnerabilities, the entry should look like this:

{
    "config": {
        "policy": {
            "advisories": {
                "ignore-id": ["PKSA-qv5y-crcz-9nxw", "PKSA-kbc7-dq62-pt7d"]
            }
        }
    }
}

... and with comments:

{
    "config": {
        "policy": {
            "advisories": {
                "ignore-id": {
                    "PKSA-qv5y-crcz-9nxw": "The affected component is not in use.",
                    "PKSA-kbc7-dq62-pt7d": "The affected component is not in use."
                }
            }
        }
    }
}

If the vulnerability does not have a CVE, you can also include the PKSA (Packagist Security Advisory) or the GHSA (GitHub Security Advisories) (you can find these in the security report on trakked). A PKSA is always available – however, a CVE is not always assigned and is therefore optional.

The outdated entry looks like this:

{
    "config": {
        "audit": {
            "ignore": ["PKSA-qv5y-crcz-9nxw"]
        }
    }
}

Of course, you can also document the reason for yourself:

{
    "config": {
        "audit": {
            "ignore": {
                "PKSA-qv5y-crcz-9nxw": "The affected component is not in use."
            }
        }
    }
}

If there are multiple security vulnerabilities, the entry should look like this:

{
    "config": {
        "audit": {
            "ignore": ["PKSA-qv5y-crcz-9nxw", "PKSA-kbc7-dq62-pt7d"]
        }
    }
}

... and with comments:

{
    "config": {
        "audit": {
            "ignore": {
                "PKSA-qv5y-crcz-9nxw": "The affected component is not in use.",
                "PKSA-kbc7-dq62-pt7d": "The affected component is not in use."
            }
        }
    }
}

Then click "Update system information" on the installation in trakked. The security message is now crossed out and will no longer be included in notifications. In the future, we plan to make it possible to maintain the list via our user interface.

Video