Larabeacon Laravel Package

Product Decisions This Supports

Initial assessment based on LaraBeacon v3.2.0.

• Upgrade roadmap prioritization: LaraBeacon now flags Laravel/PHP releases whose security support ends within support_warning_days (default 180 days) or has already ended. PMs can use this to schedule framework/runtime upgrades before support expires and can tune the threshold to company policy.
• Build vs buy: For teams needing an off-the-shelf Laravel/PHP upgrade-readiness scanner with CI and SARIF output, this is likely cheaper than building custom checks. Use the package for baseline scanning; evaluate Pro/Cloud only if additional vendor capabilities are needed.
• CI quality gate: The GitHub Action runs the CI profile, uploads SARIF to GitHub code scanning, and preserves the scan exit status. PMs can define fail-on and baseline policy and make upgrade readiness part of PR checks without breaking existing pipelines, since support checks do not run in CI mode.
• AI-assisted development workflow: Laravel Boost guidelines and the larabeacon-release-check skill let AI coding agents run release checks consistently; teams should run php artisan boost:update after updating LaraBeacon.
• Use cases: pre-upgrade audits, production-profile scans before release, recurring GitHub Actions scans, code-scanning dashboards, and developer-local scans with upgrade warnings.
• Behavior change to manage: Default and production scans now fail on support-window checks. Per the release note, Laravel 12/PHP 8.2 projects will see failures as an intended early upgrade signal. PMs should decide whether to keep 180 days, adjust support_warning_days, or document exceptions. CI mode is intentionally exempt.
• Monetization/UX consideration: Interactive scans show Pro/Cloud hints when Pro is not installed; CI, quiet, non-interactive, and exported runs omit them. This is a reasonable open-core pattern, but PMs should monitor whether prompts create friction during developer onboarding.

When to Consider This Package

• Consider it when the product is a Laravel/PHP application with an upcoming Laravel or PHP upgrade, especially when security-support deadlines affect roadmap or compliance.
• Good fit when the team uses GitHub Actions and wants SARIF findings in GitHub code scanning, or wants a configurable CI gate with baseline and fail-on behavior.
• Good fit when teams use Laravel Boost or AI coding agents and want a standard release-check skill rather than ad hoc prompts.
• Treat it as a dev-time upgrade-readiness and code-health scanner, not as runtime APM, runtime security monitoring, or a replacement for a full SAST platform.
• Look elsewhere or wrap the CLI if you need native CI integrations beyond GitHub, such as GitLab or Bitbucket, and cannot run the CLI manually.
• Look elsewhere if the organization cannot accept default scan failures from support-window checks, cannot tune support_warning_days, or has a strict no-upsell policy for developer tooling.
• Look elsewhere if you need automated remediation/codemods, multi-language scanning, or vendor-neutral security coverage; this release does not claim those capabilities.
• Adoption cost is low (composer require --dev), but confirm the team is comfortable adding a dev dependency and reviewing SARIF output.

How to Pitch It (Stakeholders)

Executive summary: LaraBeacon v3.2 is a low-cost, dev-time upgrade-readiness scanner for Laravel/PHP. It surfaces Laravel/PHP end-of-security-support risk earlier, integrates into GitHub code scanning, and supports AI-assisted development via Laravel Boost. It is not runtime monitoring. The main trade-off is intentional: default scans now fail when support windows are near, creating an early upgrade signal; teams can tune support_warning_days. CI pipelines are protected because support checks do not run in CI mode. Use it to reduce surprise upgrade work, make upgrade risk visible in roadmap planning, and standardize release checks; keep Pro/Cloud as an optional evaluation rather than an assumed requirement.