Weave Code
Code Weaver
Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.
Feedback
Share your thoughts, report bugs, or suggest improvements.
Subject
Message

Plugin Laravel Laravel Package

psalm/plugin-laravel

Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code without running it.

View on GitHub
Deep Wiki
Context7

Product Decisions This Supports

  • Enhanced Laravel Type Safety for Modern APIs: Resolves false positives in Eloquent::whereDate() for DateTimeInterface (e.g., Carbon), improving developer experience with Laravel 11–13’s stricter type expectations. Critical for APIs relying on precise date filtering (e.g., analytics, scheduling).
  • Legacy Codebase Modernization: Fixes edge cases in date-based queries, enabling safer refactoring of older Laravel apps using CarbonImmutable or DateTimeImmutable without runtime errors.
  • DevSecOps Alignment: Demonstrates the package’s commitment to Laravel-specific edge cases, reinforcing its value as a buy over custom solutions for static analysis.
  • CI/CD Stability: Reduces flaky test failures in PRs caused by incorrect type rejections (e.g., ImplicitToStringCast), improving team velocity.

Build vs. Buy: Buy (this package) to avoid maintaining custom type rules for Laravel’s evolving query builder. The fix validates its maturity for production use.


When to Consider This Package

Adopt if:

  • Your Laravel app uses whereDate() with CarbonImmutable/DateTimeImmutable (e.g., for immutable date logic).
  • You rely on Psalm 7+ for type safety and need Laravel 11–13 compatibility.
  • Your team faces false positives in static analysis for date-based queries (e.g., ImplicitToStringCast).
  • You’re migrating to immutable Carbon or need stricter type enforcement in query builders.

Look elsewhere if:

  • You don’t use whereDate() or other fixed methods in this release (low impact).
  • Your app is pre-Laravel 11 (use psalm/[email protected]).
  • You prioritize runtime validation over static analysis (e.g., manual testing).

How to Pitch It (Stakeholders)

For Executives:

"This minor update fixes a critical edge case in Laravel’s whereDate() method, ensuring our static analysis won’t block valid immutable date queries (e.g., CarbonImmutable::now()). This reduces false alarms in PRs and supports our migration to stricter type safety—without any runtime overhead. It’s a small fix with big implications for API reliability and developer productivity."

Key Outcomes:

  • Fewer CI flakes from false positives in date queries.
  • Safer refactoring of legacy code using immutable dates.
  • No cost or risk—just an improvement to existing workflows.

For Engineering Teams:

*"Psalm-Laravel v3.14.1592 fixes a bug where whereDate() incorrectly rejected CarbonImmutable/DateTimeImmutable in two-argument form. This means:

  • No more false ImplicitToStringCast errors for immutable dates.
  • Safer queries like Post::whereDate('created_at', CarbonImmutable::now()) now pass static analysis.
  • Zero impact on runtime—just better type safety.

Action: Update the plugin (composer update psalm/plugin-laravel) and re-run psalm-laravel analyze. If you were seeing false positives for date queries, they’ll disappear."*

Why Now?

  • Low effort: One composer update fixes a nagging issue.
  • High reward: Cleaner PRs, fewer CI failures.
  • Future-proof: Aligns with Laravel’s evolving type system.
Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.
Prompt
Add packages to context
No packages found.
calmfox/watch-sylius
damienfern/grpc-symfony-bundle
atoolo/index-bundle
atoolo/genai-bundle
coprotoai/laravel-ticket
davidjln/llm-carbon-bundle
cryonighter/valid-request-bundle
coolms/taxonomy-bundle
coolms/field-bundle
articulate-orm/symfony
aaix/laravel-tall-architect
ephoto/akeneo-connector
emmanuelballery/eb-plantumlbundle
emielburgman/symfony-visitor-beacon
emielburgman/symfony-visit-storage
emielburgman/symfony-security-headers
emielburgman/symfony-log-viewer
emarref/xdebug-bundle
emarref/pubnub-bundle
elriseio/finance-money-bundle