# PHP

Trivy supports [Composer][composer], which is a tool for dependency management in PHP.
The following table provides an outline of the features Trivy offers.


| Package Manager | File          | Transitive dependencies | Dev dependencies | Dependency graph | Position | License |
|-----------------|---------------|:-----------------------:|:----------------:|:----------------:|:--------:|:-------:|
| Composer        | composer.lock |            ✅            |     Excluded     |        ✅         |    ✅     |    ✅    |

## Composer
In order to detect dependencies, Trivy searches for `composer.lock`.

Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project.
Since this information is not included in `composer.lock`, Trivy parses `composer.json`, which should be located next to `composer.lock`.
If you want to see the dependency tree, please ensure that `composer.json` is present.

[composer]: https://getcomposer.org/