Using Ledge
DocsHow Ledge matches published vulnerabilities to the packages each site runs, and when it tells you.
Ledge checks every site's Composer packages against published security advisories and shows which ones affect the site, how serious they are, and which version fixes them.
Only Composer packages are checked. npm packages aren't covered yet.
composer.lock from the linked branch. It refreshes every day, and on every push.Laravel apps need a linked repository for advisories. Until one is linked, nothing is checked.
Packages installed from a branch, such as dev-main, can't be compared with an advisory's version ranges, so Ledge treats them as unaffected.
| Severity | Update by |
|---|---|
| Critical | Straight away |
| High | Within 30 days |
| Moderate | Within 90 days |
| Low | At your convenience |
Severity comes from the advisory itself. The update-by date follows Craft's security policy and is counted from when Ledge first saw the advisory. Each advisory shows Due in a number of days, Due today or Overdue.
Each row shows the installed version and the version that fixes it, or no fix released yet.
| Status | What it means |
|---|---|
| Open | The site runs an affected version. |
| Fixed | The site has moved to a fixed version. Ledge sets this itself. |
| Ignored | You've decided it doesn't apply. Ledge leaves it alone. |
To ignore an advisory, for example because the affected feature isn't used, click Ignore. Reopen puts it back. If the site has been updated since, it may go straight to Fixed.
Each scan sends one alert listing the new advisories for a site. The Security advisories setting on each notification policy sets the lowest severity that alerts. The default is Critical only. Advisories below the threshold still appear on the site's Updates page, but don't send an alert.
While advisories stay open, Ledge reminds you once a week by default. You can change this to daily, or to new advisories only.
If scheduled update runs are on and Respond to advisories is ticked, an advisory with a fix in the same major version starts an update run straight away, skipping the schedule and cooldown. It still ends as a pull request for you to review, unless you've turned on auto-merge.