psalm/plugin-laravel
Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code without running it.
Eloquent::whereDate() for DateTimeInterface (e.g., Carbon), improving developer experience with Laravel 11–13’s stricter type expectations. Critical for APIs relying on precise date filtering (e.g., analytics, scheduling).CarbonImmutable or DateTimeImmutable without runtime errors.ImplicitToStringCast), improving team velocity.Build vs. Buy: Buy (this package) to avoid maintaining custom type rules for Laravel’s evolving query builder. The fix validates its maturity for production use.
Adopt if:
whereDate() with CarbonImmutable/DateTimeImmutable (e.g., for immutable date logic).ImplicitToStringCast).Look elsewhere if:
whereDate() or other fixed methods in this release (low impact).psalm/[email protected])."This minor update fixes a critical edge case in Laravel’s whereDate() method, ensuring our static analysis won’t block valid immutable date queries (e.g., CarbonImmutable::now()). This reduces false alarms in PRs and supports our migration to stricter type safety—without any runtime overhead. It’s a small fix with big implications for API reliability and developer productivity."
Key Outcomes:
*"Psalm-Laravel v3.14.1592 fixes a bug where whereDate() incorrectly rejected CarbonImmutable/DateTimeImmutable in two-argument form. This means:
ImplicitToStringCast errors for immutable dates.Post::whereDate('created_at', CarbonImmutable::now()) now pass static analysis.Action: Update the plugin (composer update psalm/plugin-laravel) and re-run psalm-laravel analyze. If you were seeing false positives for date queries, they’ll disappear."*
Why Now?
composer update fixes a nagging issue.How can I help you explore Laravel packages today?