I am working on a php project that uses composer but some of the dependencies are very old, including the php version. We are trying to convince the client to upgrade the version of php and consequentially all other dependencies. We would like to run an analysis on the existing dependencies and look for known vulnerabilities on those.

Are there any tools available for php that run [dependency check](https://www.owasp.org/index.php/OWASP_Dependency_Check)?

I have done this with ruby projects using [bundle audit](https://github.com/rubysec/bundler-audit) but I haven't been able to find a similar tool for php.