- What is nunomaduro/patrol and what does it actually do?
- Patrol is a standalone command-line tool distributed as a Composer binary that inspects your project's composer.json and composer.lock and prints a report about the state of your dependencies. It is built on Laravel Zero (Symfony Console) rather than being a Laravel package, so there is no service provider, facade, or runtime wiring. The most credible reading of its behaviour is outdated-package and security-advisory reporting, so treat it as a presentation layer over data Composer already produces. It is installed with require-dev and executed as vendor/bin/patrol.
- How do I install Patrol in a Laravel project?
- Install it as a dev dependency with composer require --dev nunomaduro/patrol, then invoke it with vendor/bin/patrol from your project root. There is no migration, schema change, publishable config, or application bootstrapping step. Because it reads the lock file from the working directory, run it from the repository root where composer.json lives.
- Is Patrol a Laravel package or a standalone CLI tool?
- It is a standalone CLI built on Laravel Zero, the console micro-framework, not a Laravel framework package. That means it works in any Composer-based PHP project, Laravel or otherwise, and has no coupling to your application's container or HTTP kernel. The practical benefit is zero production blast radius: nothing is registered at runtime and it can be removed at any time.
- What does Patrol report that composer audit and composer outdated --direct do not?
- Based on its documented and observed behaviour, very little: the core ground it covers overlaps with composer outdated --direct and composer audit, which shipped natively in Composer 2.4 and later. Patrol's value proposition is therefore presentation and ergonomics rather than new capability. Run it alongside the native commands for a sprint or two and diff the findings before deciding to keep it.
- Do I need to publish a config file or register a service provider for Patrol?
- No. Patrol has no service provider, no facade, and no publishable configuration, so there is nothing to register in config/app.php or bootstrap/providers.php. Its inputs are the composer.json and composer.lock files in your project root. Any behaviour customisation should be assumed to come from CLI flags, which you should verify against the repository before relying on them.
- Can I run Patrol in CI and does it produce machine-readable output?
- Yes, the standard integration is a require-dev install plus a CI step that invokes vendor/bin/patrol and archives the output as a build artifact. What is less clear from the project's own documentation is whether it emits JSON output and documented exit codes, which matters for failing a pipeline automatically. Verify both before making the job blocking; otherwise keep it non-blocking and review the human-formatted report manually.
- Which PHP and Composer versions does Patrol support?
- The exact constraints are declared in the package's own composer.json, and low-adoption tools often lag current PHP 8.x runtimes, so check them against your full runtime matrix before adopting. Patrol also pulls in Laravel Zero's transitive dependency tree, which is worth reviewing given it is a dependency-hygiene tool. Confirm Composer 2 lock-file handling and test on monorepos or projects using path repositories, where lock files are partial.
- Is Patrol safe to run in production?
- It is designed as a development and CI tool, so it should live in require-dev and never ship to production. Because it executes inside CI with your tokens and network identity while reading your lock file, it belongs to the same supply-chain surface it claims to police. Pin the exact version, audit what it does, and treat any outbound calls to Packagist or an advisory endpoint as part of your egress review.
- Is nunomaduro/patrol actively maintained and safe for long-term use?
- Signals are weak: roughly 280 stars, no dependents, a single named maintainer, and a low overall package score point to a convenience-tier tool with limited adoption. The dominant risk is lifecycle rather than code quality, compounded by the fact that its core functionality has been commoditised by native Composer commands. Pilot it in one repository behind a non-blocking job rather than standardising it across the organisation.
- How do I remove Patrol, and what are the alternatives?
- Removal is a single composer remove --dev nunomaduro/patrol with no cleanup of migrations, config, or application code. The built-in alternatives are composer outdated --direct and composer audit, which require no extra dependency and cover the same advisory and version-drift ground. If you retain Patrol, wrap it in a Composer script or Makefile target so it is never invoked ad hoc with an unpinned version, and assign a named owner to triage its output each cycle.