- What is nunomaduro/pet used for in a Laravel project?
- Pet, also referred to as Vet, is a dev-time static analysis CLI that audits your Composer dependency graph. It reads composer.lock and a repo-local vet.json configuration to apply trust policies such as a minimum release age, rather than instrumenting your application at runtime. It sits in the same tier as PHPStan, Pint, and Rector, so it belongs in your quality gate rather than your production stack.
- How do I install Pet in a Laravel application?
- Install it as a dev dependency with composer require --dev nunomaduro/pet, or install it globally if you want to run it across multiple repositories. There is no service provider, container binding, middleware, or production configuration to register. Invocation is a CLI command suitable for a CI step, a pre-push hook, or a scheduled job.
- Does Pet require a specific Laravel or PHP version?
- Pet has no Laravel version constraint because it does not integrate with the framework runtime; it only needs a Composer-based project with a lock file. Check the package's composer.json for its PHP version requirement before installing. The technical assessment confirms there is no service provider or container surface to worry about.
- What is vet.json and should I commit it to the repository?
- vet.json is a declarative, repo-local configuration file used by the tool, and v0.2.1 confirms it can be committed with settings such as minimum release age. Commit it so dependency policies are reviewable, diffable, and easy to copy across repositories. Treat it as versioned code and review changes in pull requests.
- Is Pet a replacement for composer audit?
- It is not a full replacement, but it overlaps and adds a meaningful differentiator. composer audit checks advisory feeds, while Pet's minimum release age setting enforces a cooldown window against freshly published versions, which is a supply-chain compromise defence native Composer does not offer. Running both gives you advisory coverage plus release-age policy.
- Does the minimum release age setting apply to transitive dependencies?
- This is a key question to validate before a pilot, because the assessment does not confirm whether the policy evaluates only direct dependencies or the full transitive graph. Test it against a real composer.lock with nested packages. Confirm the behaviour, including path, VCS, and private packages, before relying on it as a fleet-wide gate.
- How do I run Pet in CI, and will it fail the build on findings?
- Pet is a CLI command, so it fits naturally as a CI step, a pre-push hook, or a scheduled job. The assessment notes that non-zero exit behaviour, severity threshold flags, and machine-readable output still need validation. Test exit codes and define a noise budget before making it a blocking quality gate.
- Does Pet add runtime overhead or production risk to my Laravel app?
- No runtime overhead is expected because it is a dev-time CLI that audits composer.lock rather than instrumenting the application. It adds no service provider, container bindings, middleware, or production config surface. Keep it in require-dev and your CI pipeline.
- Why does the Composer name nunomaduro/pet not match the laravel/vet repository?
- That mismatch is a governance blocker flagged in the technical assessment. Before installing, confirm that the Composer package name resolves to the official repository with verified tags. Do not assume package identity from the name alone; verify the source and release history.
- Is Pet actively maintained and safe to adopt?
- Pet is pre-1.0 with a small install base and no downstream validation pool, so treat adoption as a controlled pilot. It occupies the PHPStan, Pint, and Rector quality-gate tier and complements composer audit rather than replacing it. Pin the exact version, review vet.json changes carefully, and monitor releases before a fleet-wide rollout.