Skip to content


Check Drupal Composer packages for pending security updates.

This uses the Drupal security advisories package to determine if updates are available. An exit code of 3 indicates that the check completed, and insecure packages were found.


  • drush pm:security --format=json. Get security data in JSON format.
  • HTTP_PROXY=tcp://localhost:8125 pm:security. Proxy Guzzle requests through an http proxy.


  • --no-dev. Only check production dependencies.
  • --format=FORMAT. Format the result data. Available formats: csv,json,list,null,php,print-r,sections,string,table,tsv,var_dump,var_export,xml,yaml [default: table]
  • --fields=FIELDS. Available fields: Name (name), Installed Version (version) [default: name,version]
  • --field=FIELD. Select just one field, and force format to string.
  • --filter[=FILTER]. Filter output based on provided expression



  • sec
  • pm-security


  • An argument or option with square brackets is optional.
  • Any default value is listed at end of arg/option description.
  • An ellipsis indicates that an argument accepts multiple values separated by a space.