Weave Code
Vet Laravel Package
laravel/vet
Laravel Vet is a static analysis tool for Laravel apps that scans your codebase for security vulnerabilities and risky patterns—SQL injection, mass assignment, unsafe queries, and more—so you can catch and fix issues before they reach production.
Laravel Vet audits your application's Composer dependencies for known security vulnerabilities, giving you a fast, Laravel-native way to catch risky packages before they reach production. Run it through Artisan to check installed packages against the PHP security advisories database and get clear, actionable output.
- Artisan command for on-demand dependency audits
- Detects known vulnerabilities in installed packages
- Reports affected versions and available fixes
- CI-friendly exit codes for automated pipelines
- Simple configuration for ignoring accepted risks
Frequently asked questions about Vet
- What is Laravel Vet and what does it do?
- Laravel Vet is a PHP dependency audit tool packaged for Laravel applications. It inspects your Composer dependencies to help surface known security issues so you can address them before they reach production. It is distributed as the laravel/vet Composer package and documented in the GitHub repository.
- How do I install Laravel Vet in a Laravel project?
- Install it with Composer, typically as a development dependency using composer require --dev laravel/vet. Keeping it in require-dev helps avoid adding audit tooling to your production dependency set. Check the repository README for any additional publishing or configuration steps.
- Which Laravel versions are supported by Laravel Vet?
- The repository README and composer.json are the authoritative sources for supported Laravel and PHP versions. As a Laravel-owned package, it generally targets maintained Laravel releases and modern PHP versions. Verify the version constraints before adding it to an older application.
- How do I run a dependency audit with Laravel Vet?
- After installation, run the audit command documented in the package README from your project root. The tool evaluates your Composer dependency graph and reports the issues it finds. Use that output to prioritize dependency updates or replacements.
- Can I use Laravel Vet in CI/CD pipelines?
- Yes, dependency audits are most useful when automated in CI. Add the audit command to your pipeline so pull requests or deployments warn or fail when vulnerable packages are detected. Confirm the exit codes and failure behavior in the README before enforcing it as a gate.
- Does Laravel Vet replace Composer audit or other security tools?
- Laravel Vet complements Composer audit and other security scanners rather than automatically replacing them. Use it alongside regular Composer updates, static analysis, and runtime monitoring for layered protection. Refer to the README for the specific checks and data sources Laravel Vet uses.
- Is Laravel Vet safe to run in production?
- Laravel Vet is intended for development and CI auditing workflows, so install it as a dev dependency where possible. Run audits in deployment pipelines rather than in production request paths. Keep production dependencies lean by keeping audit tooling out of the runtime package set.
- How do I configure Laravel Vet for my project?
- Configuration options, if any, are documented in the repository README and package configuration files. Start with the defaults, then adjust ignore rules or severity thresholds only when your team has a clear policy. Avoid suppressing findings without tracking the underlying dependency risk.
- How should I test that Laravel Vet works in my app?
- Run the audit command locally against your project and review whether the output matches expectations. In CI, verify that an intentionally outdated or vulnerable dependency triggers the intended warning or failure. Follow the README for any example commands or test fixtures.
- Who maintains Laravel Vet and where can I get help?
- Laravel Vet is maintained under the official Laravel GitHub organization as laravel/vet. Use the repository issues and discussions for bug reports and usage questions, and check the README first. For security-sensitive reports, follow the responsible disclosure guidance in the repository.
Weaver
How can I help you explore Laravel packages today?