An inventory shows which machines or images have particular runtimes, libraries, web servers and extensions. It helps teams answer the first question after a new advisory: where might the affected package exist?
Useful records include package name, version, build identifier, architecture, source repository, system owner and deployment location. On a container platform, the image contents can matter more than packages installed on the underlying host. Several versions of PHP may also coexist under separate paths.
Inventories grow stale quickly if they rely only on occasional manual exports. Automated discovery, image scans and records tied to deployments improve coverage, but they still need checks for unsupported or manually installed software.
Maintain an inventory for every environment that runs production workloads, compare it with vendor advisories and link identified packages to the services that actually use them. Update the record after patches and redeployments.