>_ phpunit.expert █

Interactive online training

Dependency Management & Supply Chain Security

80 to 95 percent of your application is code you did not write. Learn how to master dependencies, secure your supply chain, and automate updates. With the creator of PHPUnit.

Book now The programme
Online via Zoom Live & interactive
5 sessions 2 hours each
PHP & Composer Hands-on with an example project
990 EUR included in the flat rate

The situation

Most of the code is not your code

Frameworks, libraries, a transitive web of dependencies: the largest part of your application does not come from you. When that code is compromised, your application is compromised. And the threat landscape is getting worse.

Faster discoveries

Security vulnerabilities are found faster and faster, through better static analysis and through LLM-based tools.

More attacks

Supply chain attacks on open source packages are increasing, from typosquatting to account hijacking.

AI without oversight

AI agents add dependencies without anyone checking the consequences.

Postponed updates

Updates are postponed until at some point nothing fits together any more.

In this training you learn to think about dependency management and supply chain security as a whole: advanced use of Composer, design patterns for decoupling dependencies, the threat model of the software supply chain, and the automation of safe updates. You get the tools, the mental model, and the practices to keep dependencies under control permanently, even as the threat landscape keeps getting worse.

The example project

From poorly maintained to production-ready

One continuous example project accompanies you through all five sessions. It starts as a poorly maintained project and is developed step by step into a production-ready, secured, and automated project that you take away as a reference after the training.

The programme

Five sessions, one common thread

From the symptom to the solution, from securing to automating. Each session lasts two hours, live and interactive, and delivers a concrete artefact that you can apply in your own projects afterwards.

Session 01

The situation & the Composer foundation

2 hours
Fundamentals that are anything but basic
  • Real incidents as a picture of the situation: what actually happens in supply chain attacks
  • Composer mechanics under the hood: what really happens on require, install, and update
  • composer.json vs. composer.lock: why the difference is relevant to security
  • Using semantic versioning, version constraints, and platform requirements deliberately
Session 02

Composer for real projects

2 hours
Configuration & operation
  • Setting up private repositories and authentication cleanly
  • Composer plugins as a security topic: code that runs on every installation
  • Autoloading strategies and their consequences
  • Scripts and hooks: automation in moderation
Session 03

Architecture

2 hours
Decoupling
  • Decoupling dependencies with adapter, facade, and anti-corruption layer
  • Updating and swapping libraries without a chain reaction
  • Where decoupling pays off and where it only adds complexity
  • Applying the patterns in practice on the example project
Session 04

Supply chain security

2 hours
Threat model
  • The threat model in depth: SBOM, SLSA, typosquatting, account hijacking
  • composer audit in practice: assessing findings soundly instead of reacting blindly
  • Roave Security Advisories: not installing vulnerable versions in the first place
  • LLM-based security tools: what they can do and where their limits are
Session 05

Automating updates

2 hours
Permanently up to date
  • Configuring Renovate: from the first pull request to the merge strategy
  • CI as a safety net for automated updates
  • Handling PHP major updates with Rector
  • Establishing guardrails for AI agents in the update process

Who it is for

Who should attend?

What you take away

  • You configure Composer specifically for real requirements, including private repositories, platform requirements, and authentication
  • You use version constraints deliberately and know which operator fits when
  • You decouple dependencies architecturally, so that updates and swaps do not trigger a chain reaction
  • You understand the threat model of the software supply chain and assess audit findings soundly
  • You automate updates with Renovate, secured by CI, so that your project stays up to date permanently
  • You have an approach for AI agents that add dependencies
  • You take the example project away as a reference for your own projects

What you bring

  • A few months of experience with PHP or a similar programming language
  • Basic Composer knowledge is helpful, but not a requirement: we build the mental model from the ground up
  • A local development environment with PHP 8.2 or newer, Composer, Git, and a terminal
  • An editor of your choice

Your trainer

Sebastian Bergmann

Sebastian Bergmann

Sebastian is the creator of PHPUnit, the de facto standard for testing PHP code. As a consultant, trainer, and co-founder of thePHP.cc he has been helping teams build maintainable and well-tested software for more than two decades.

In this training you develop a poorly maintained project with him, step by step, into a production-ready, secured, and automated project. Live, on real code, with your questions.

Sebastian Bergmann answering a participant's question at the laptop
Sebastian answers questions at a workshop. Photo: Filip Kovačević

Registration

990 EUR per person

Five interactive live sessions of two hours each, as a Zoom meeting. Small group, a real project, your questions.

Book now
This training is included in our subscription for all thePHP.cc Academy training courses.