A known advisory matches an inventoried dependency, or the Dockerfile's PHP branch has a security release newer than its version. Plan an update within the supported version policy.
no-match
No known advisory or newer PHP security release matches the recorded inventory; the PHP branch's newest release can still be shown when it is not a security release, with its 72-hour wait. This is not a guarantee that the application is secure.
unknown
A source cannot be reached or read, or the project changed while checking. Report the gap instead of marking the project clear.
unsupported
An unsupported manifest, unresolved model or untrusted acquisition path needs review. It remains visible instead of being silently skipped.
Read installed versions from npm and Composer lockfiles, or, in a read-only scan, resolve a standalone Maven dependency graph. PHP runtime releases use the configured Dockerfile. Dependency advisories come from OSV.
Illustrated workflow. Run the preview to produce your own results.
Check every update.
update.check
Match
Identify exact versions and match them against published advisories. Keep existing package majors; fixes that require a major upgrade stay visible for review.
Resolve
Resolve packages in a separate acquisition environment. Keep application files out of online resolution, constrain download sources, and pin the tool image by digest.
Test
Build baseline and candidate application images. Run your configured test offline on both and recheck the candidate dependency inventory for known advisories.
Record
Keep advisory ids, version inventories, image ids, source hashes and test outcomes in a local receipt, with each applied fix's branch and commit.
A failed baseline, failed candidate, remaining advisory, incomplete inventory or changed project blocks application. Passing tests establish only the recorded application behavior.
You choose the application test. Ludion does not invent a passing test, weaken it, or treat an unavailable database as a clean result.
Illustrated workflow. Run the preview to produce your own results.
Resolve once. Check the app. Apply by policy.
patch.workflow
patch→dependency files
security updatepatch
security patchdependency files
security updatepatch
1 · Resolvedependency files
security patchpatch
Workflow illustration, not a completed update. Nothing is installed or executed by this page.
1 · Resolve
Acquire dependencies separately from application testing. npm blocks URL/Git/file dependencies; Composer archives are checked at each redirect.
2 · Validate
Run the original and updated application tests in Docker with no network, a read-only source/root, a non-root user and fixed scratch/resource limits. Check the resulting inventory again.
3 · Apply
With --apply, commit each fix that passes on its own to a new Git branch. Your files and current branch stay unchanged. Production deployment remains a separate step.
Online acquisition contains dependency manifests, not application source or host credentials. Application tests run offline. Source remains local to your configured Docker setup.
Run watch --apply to repeat the saved ecosystem policy. A stop request cancels pending application; a Docker step already in flight may finish before exit.
Workflow illustration, not a completed update. Nothing is installed or executed by this page.
security update
patch
1 · Resolvedependency files
security patchpatch
tested update
security update
Know what changed, and what remains.
update.receipt · example
Advisory source and matching ids
Recorded per run
Before / after dependency inventories
Recorded per run
Source tree and dependency file hashes
Recorded per run
Tool image digest and application image ids
Recorded per run
Application test command
Recorded per run
Baseline / candidate test outcome
Recorded per run
Candidate advisory recheck
Recorded per run
Each applied fix's branch and commit
Recorded per run
Production deploymentNot changed
Receipt structure, not a run result. Actual receipts stay in .ludion/security/. No security certification is implied.
Source preview · PHP Docker, npm package-lock and Composer. Standalone Maven is scanned only, with no updates. Source updates are validated locally; production deployment stays with your release process.
Know the supported scope.
Your stack
Detect
Validate & apply
Current boundary
PHP runtime
Official security releases and the branch's newest release (a 72-hour wait when no security release is newer than the Dockerfile's version)
Dockerfile update
Exact official PHP image; single stage; same major/minor branch.
JavaScript / TypeScript
npm lockfile + OSV
Manifest + lockfile
Public npm registry; package-lock v2/v3; no workspaces, URL/Git/file deps or major upgrades.
PHP packages
Composer lockfile + OSV
Manifest + lockfile
Public pinned ZIP archives; standard vendor directory; no custom repositories or policy overrides.
Java / Maven
Resolved graph + OSV
Read-only scan; no updates
Standalone POM; public Maven Central. Parents, profiles, modules and extensions need review.
Yarn/pnpm discovery is partial and does not enable automatic patching. Python, Go and Rust are scanned read-only, with no updates. Gradle, live server inventory, runtime upgrades beyond PHP and Node.js and automatic production deployment are not supported in this preview. Custom build tools may need an explicitly trusted offline cache.