Magebean Logo Magebean
← Back to Baseline

MB-0810

Partially automated Declared Composer package names are available

MB-C20 Module Integrity & Compatibility Medium

Package names in selected modules’ Composer require metadata appear in the installed package inventory or a collected provide or replace declaration.

Overview

Compare selected module composer.json require names with installed metadata and collected provide/replace declarations. A lock entry alone does not establish installed availability.

Why it Matters

A declared dependency that is unavailable can leave selected module behavior incomplete.

Interpret the reported resource and collection scope before making changes. Unsupported source, unresolved symbols and bounded collection gaps cannot establish a clean result.

Verification Steps

Manual Verification

  1. Compare selected module composer.json require names with installed metadata and collected provide/replace declarations. A lock entry alone does not establish installed availability.
  2. Inspect the reported file, declaration, package or evidence record in the same selected release. Keep source observations separate from effective runtime behavior.
  3. Apply the rule-specific remediation below, validate the affected behavior in staging, and rerun the same selection.

Command / Review Sample

php magebean.phar audit --path=/var/www/magento --profile=module-integrity --rules=MB-0810 --modules=Vendor_Module

Use the assessed Magento project and the appropriate application or read-only review account. Replace example hosts, paths and identifiers with the assessment scope; configuration and source fragments are illustrative.

Remediation / Fix Guidance

  1. Install the required package or correct the dependency declaration.
  2. Verify the corrected behavior in an authorized staging environment.
  3. Rerun MB-0810 with the same module selection.

Examples

Illustrative declaration/review examples, not recorded scan output. A pass example concerns only the stated predicate and supported collected scope.

Fail Example

require: vendor/library
Installed inventory has no vendor/library, provider or replacement.

Pass Example

require: vendor/library
Complete installed inventory contains vendor/library.
Version compatibility and activation require separate review.

Scope and Evidence Limits

Rule revision: 1. Target modes: LOCAL.

Package names in selected modules’ Composer require metadata appear in the installed package inventory or a collected provide or replace declaration.

Checks package identity only. Does not assess versions, platform constraints, module enablement, or sequence as a dependency list.

Catalog coverage describes implementation capability, not a scan outcome. An incomplete manual review cannot establish that the criterion is satisfied.

References