- What is laravel/vet (nunomaduro/porto) and what does it do?
- It is a developer-facing dependency audit and trust-file tool for PHP projects, configured through a vet.json file. It evaluates dependency releases, including a minimum release age setting that acts as a cooldown or quarantine policy for new packages. It is intended to run locally and in CI as a require-dev tool, not in the production dependency graph.
- How do I install laravel/vet in a Laravel application?
- Install it as a dev dependency with Composer and add a vet.json configuration file at the project root. You then run the tool's command against your existing composer.lock, so no application code changes are needed. The v0.2.1 release specifically permits a minimal vet.json that only sets minimum release age, which lowers the cost of a narrow pilot.
- What is the minimum release age setting in vet.json?
- It is a cooldown policy that refuses dependency releases that are newer than a configured age threshold. That makes the tool more than a CVE scanner: it makes assertions about when code may enter the build. A misconfigured threshold can block routine dependency updates, so treat it as a policy surface rather than a linter warning.
- Can laravel/vet block security patches?
- Yes, by construction an age-based gate will block a freshly published security patch until it passes the cooldown window. Teams need a documented break-glass path, or they will face a choice between a known vulnerability and disabling the gate. This is the main new risk introduced by the cooldown feature.
- Can I use laravel/vet as a CI gate?
- Yes, but it changes the blast radius: as a CI gate it can block merges and dependency upgrades, not just emit warnings. Ownership should be clear, arguably with the security or supply-chain owner rather than only the dependency-update owner. Start with an advisory local run and tighten to a gate after you understand the thresholds.
- Does laravel/vet support Laravel 10 or 11?
- The provided context does not document specific Laravel or PHP version constraints. Because the tool is low-coupling and configuration is a JSON file rather than a service provider, framework intrusion is minimal, but you should verify the composer.json constraints before pinning. It remains pre-1.0, so compatibility and schema details may change.
- Is laravel/vet safe to use in production?
- It belongs in require-dev and CI, never in the production dependency graph, so it does not ship to production. The production concern is indirect: a CI gate misconfiguration can block releases or emergency patches. Keep the tool out of runtime dependencies and document how to bypass the gate during incidents.
- How mature and actively maintained is laravel/vet?
- The context describes v0.2.1 as a patch that fixed a first-run configuration defect, which suggests a lightly trodden onboarding path. It has a single-maintainer pattern and no visible dependents, so bus factor and adoption evidence are risks. Release metadata is also anomalous, including a future-dated release, so do not treat version strings as a stability signal.
- Why is the Composer package nunomaduro/porto when the repository is laravel/vet?
- That identity ambiguity is unresolved in the provided material and nothing in v0.2.1 addresses it. It matters because you need to know exactly which package and repository you are pinning, auditing, and granting CI authority. Settle the package identity before adopting it in a gate.
- What alternatives to laravel/vet exist for dependency auditing?
- Composer's built-in audit and stability heuristics cover vulnerability reporting and some release-selection behavior, but they are not the same as an enforced cooldown gate. Laravel/vet's differentiator is the vet.json policy file with minimum release age. If you only need CVE warnings, a simpler advisory tool may be enough; if you need supply-chain timing policy, vet is aimed at that.