- How do I install Doctrine Doctor in a Symfony application?
- Install it with Composer as a development dependency using composer require --dev ahmed-bhs/doctrine-doctor. Symfony Flex configures the bundle automatically through its recipe, so no manual registration is needed. For non-Flex projects you register the bundle in config/bundles.php and add the required YAML configuration.
- Which Symfony, Doctrine, and PHP versions does Doctrine Doctor support?
- It supports Symfony 6.x, 7.x and 8.x, Doctrine ORM 3.x and 4.x, and requires PHP 8.4 or newer. Projects still on Symfony 5.x or older PHP versions would need an upgrade path first. Check the Composer constraints before adding it to a legacy application.
- Does Doctrine Doctor slow down Symfony requests?
- Some overhead remains because analysis happens at runtime, but v2.11.2 moved the parser cache, on_view timing, AI Mate and recipe components off the request-blocking path and made the pending-analysis listener lazy. The residual cost is measured in milliseconds per request, which is acceptable for dev and staging. Re-baseline your request latency after upgrading to confirm the improvement holds in your environment.
- How does Doctrine Doctor detect N+1 queries differently from PHPStan or Psalm?
- Static analyzers like PHPStan and Psalm inspect code without executing it, so they cannot see real parameters, data volume, or query plans. Doctrine Doctor analyzes the actual execution context, which lets it confirm N+1 patterns and point to the exact template line responsible. That runtime focus is also what surfaces environment-specific problems that only appear in staging or production-like data.
- Does Doctrine Doctor detect SQL injection and sensitive data exposure?
- Yes, its security analyzers flag DQL and SQL injection vulnerabilities, QueryBuilder SQL injection risks, and sensitive data exposure during serialization. It also checks for unprotected sensitive fields and insecure random generators. These findings appear in the Web Profiler panel alongside performance and integrity issues so you can prioritize them.
- Can I use Doctrine Doctor in production?
- It is designed as a development tool and should be installed with the --dev flag. Disabling it in production is explicit and safe, so no analyzers run against live traffic. The usual setup is to keep it enabled in local and staging environments where the Symfony Web Profiler is available.
- Why are missing index warnings not showing up in Doctrine Doctor?
- Missing index detection relies on EXPLAIN, so the database user behind your Doctrine connection needs permission to run it. Teams using restricted database roles may need to grant EXPLAIN or provide a dedicated analysis connection. For precise code locations, also enable profiling_collect_backtrace: true in Doctrine DBAL.
- How do I tune Doctrine Doctor thresholds to avoid false positives?
- Start with the default analyzer settings and review the reported issues against problems you already know about. Options such as n_plus_one.threshold can be adjusted when a warning is not actually a problem in your context. Tuning thresholds per project keeps the Profiler panel useful instead of noisy.
- Can Doctrine Doctor fail a CI build when critical issues are found?
- The tool is built around the Symfony Web Profiler, so CI enforcement means running your test or staging environment with profiling enabled and evaluating the reported issues. Many teams surface critical findings and fail builds on them, while others start with reporting only. Keep an eye on analysis time in pipelines because runtime analysis adds cost.
- What are the AI Mate and recipe components added in Doctrine Doctor v2.11.2?
- They are additive features introduced between v2.7.3 and v2.11.2 that now run off the request-blocking path. Before rolling out, validate their scope, any outbound network calls or telemetry, and their configuration impact in your environment. The release notes are the authoritative source for what each component does.