- How do I install dominikb/composer-license-checker in a Laravel project?
- Install it as a development dependency with composer require --dev dominikb/composer-license-checker, then invoke it as a Composer script or a dedicated step in your CI workflow. It is a Composer-level tool rather than a framework package, so there is no service provider to register and no config file to publish. Keep it out of production images since it only needs to run alongside your build.
- Does composer-license-checker support Laravel 10, Laravel 11 and PHP 8.x?
- The tool is stack-agnostic across Composer 2.x projects, so it works with Laravel 8 through current releases as well as standalone PHP libraries and internal packages. It is documented as compatible with PHP 7.4+ and 8.x. Because it tracks the Composer plugin API, a Composer major upgrade is the main compatibility event to watch rather than a Laravel version bump.
- How do I configure which licenses are allowed or denied?
- The tool is policy-driven: you define an allow/deny list of licenses and it flags any installed dependency that falls outside those rules. The exact config file location and key names should be taken from the README for the specific version you pin, since the policy schema is the part most likely to change between releases. A practical starting point is auto-approving MIT, Apache-2.0, BSD and ISC, requiring review for LGPL, GPL and AGPL, and blocking unknown or proprietary licenses pending clarification.
- Can it check dev dependencies separately from production dependencies?
- That distinction matters a great deal, because a GPL test utility carries a very different risk profile from a GPL runtime dependency. The overview describes scanning the dependency graph resolved in composer.lock, but whether require and require-dev are reported separately, and whether policy can differ between them, must be confirmed against the source rather than assumed from the README. Verify this before you switch on enforcement.
- How do I run the license check in CI and fail the build on unwanted licenses?
- Wire the checker into your existing pipeline next to PHPUnit and static analysis, and rely on its exit code to break the build on protected branches. Start in report-only mode on a representative repository to establish a baseline, then flip to blocking enforcement once the policy has been agreed with legal. Also confirm whether the tool reads only the lockfile or contacts Packagist, since network calls are a CI reliability concern.
- What happens if a dependency has no license, a non-SPDX string, or a dual license?
- Detection is only as good as the metadata in third-party composer.json files, so packages that omit a license field, declare a non-SPDX string, or dual-license will produce ambiguous results. Whether these cases fail open or fail closed is a behaviour you must verify in the source and test with a deliberately malformed fixture before trusting the output. The safest policy is to treat unknown or malformed licenses as blocked pending manual review.
- Why did the license checker silently pass in CI without running?
- As a Composer plugin it can be affected by Composer 2.2+ allow-plugins configuration, and if the plugin is not explicitly permitted in composer.json the check may never execute while the pipeline still goes green. That is a false sense of compliance and the most dangerous failure mode for this kind of tooling. Explicitly allow the plugin in composer.json and add a smoke test that proves the check actually runs.
- Does it produce JSON or another machine-readable output for dashboards and SBOMs?
- Console output is the baseline expectation for a tool of this scope, but whether a structured JSON format is available should be verified against the source for your pinned version. If only human-readable output exists, you can parse the console report or pair the check with a dedicated SBOM generator. Machine-readable output is what makes license inventory trackable over time rather than a one-off gate.
- Is dominikb/composer-license-checker actively maintained and safe to depend on?
- It is a single-maintainer project with a modest star count, so it is bus-factor-one tooling; a recent release is a positive signal of activity but there is no institutional backing. Pin to a specific minor version, review the changelog on every upgrade, and keep a fallback option in mind. Because it is a dev-only dependency, the blast radius of a maintenance lapse is limited to your pipeline rather than your application.
- What are the alternatives to composer-license-checker and what would migration cost?
- Credible alternatives include Licensee and the commercial software composition analysis tools, which typically add dashboards, SBOM export and broader ecosystem coverage at the cost of a vendor relationship. Migration cost is mostly re-encoding your allow/deny policy into the new tool's format, not rewriting application code. Keeping the policy in a shared, versioned config file makes any future switch cheap.