Weave Code
Security Advisories Health Check Laravel Package
spatie/security-advisories-health-check
A Laravel Health check that reports known security advisories for your installed PHP packages, sourced from Packagist, GitHub and other sources. Supports configurable retries, result caching, and ignoring specific packages to reduce API calls.
spatie/security-advisories-health-check adds a Laravel Health check that reports known security vulnerabilities in your application's installed PHP packages. Advisories are fetched from Packagist, sourced from GitHub and other feeds, and surfaced directly in your health check results so issues are visible alongside your other application metrics.
- Fetch advisories for all installed Composer packages automatically
- Optional caching with configurable duration to reduce Packagist API calls
- Retry configuration for flaky network conditions
- Ignore specific packages or whole lists via
ignorePackage()andignoredPackages() - Integrates seamlessly with Laravel Health
Frequently asked questions about Security Advisories Health Check
- What does spatie/security-advisories-health-check do?
- It adds a SecurityAdvisoriesCheck to Laravel Health that reports known security advisories for the PHP packages installed in your application. The advisory data is fetched from Packagist, which sources it from GitHub and other upstream feeds. It is a single health check, not a standalone dashboard; it renders inside your existing Laravel Health dashboard or JSON endpoint.
- How do I install spatie/security-advisories-health-check?
- Install it with Composer using composer require spatie/security-advisories-health-check. Because it is a Laravel Health check, you also need spatie/laravel-health installed and configured in the same application. After installation, register the check in a service provider as shown in the README.
- Do I need spatie/laravel-health to use this package?
- Yes. This package provides a check that implements the Laravel Health check contract; it does not provide its own dashboard, routes, migrations, or storage. Adopting it means adopting the laravel-health runtime as a prerequisite. If you are already running spatie/laravel-health, integration is essentially zero-friction.
- How do I register SecurityAdvisoriesCheck in a Laravel service provider?
- Use the Health facade in a service provider and add SecurityAdvisoriesCheck::new() to Health::checks([...]). You can chain options such as retryTimes(5), cacheResultsForMinutes(60), and ignorePackage('vendor/package') directly on the check. No routes or migrations are needed because the check renders through your existing Laravel Health setup.
- How do I enable caching for the security advisories check?
- Call cacheResultsForMinutes() on the check, for example SecurityAdvisoriesCheck::new()->cacheResultsForMinutes(60) for a one-hour cache. By default the package makes an HTTP request to Packagist every time the health check runs, so caching reduces API calls and latency. It uses Laravel's default cache driver, so choose a driver and TTL that match your staleness tolerance and Packagist call budget.
- How can I ignore specific packages in the security advisories check?
- Use ignorePackage('vendor/package') for one package or ignoredPackages([...]) for multiple packages on the SecurityAdvisoriesCheck instance. This is useful for known false positives, abandoned packages you have accepted, or dependencies outside your remediation scope. The README shows both methods in the configuration options example.
- How do I configure retries when Packagist is unreachable?
- Call retryTimes() on the check, for example SecurityAdvisoriesCheck::new()->retryTimes(5). Retries exist because outbound Packagist calls can fail or be slow; version 1.2.1 specifically addressed connection errors surfacing as false positives. Pair retries with cacheResultsForMinutes() to reduce the number of uncached outbound requests.
- Which Laravel and PHP versions does this package support?
- The README does not list explicit Laravel or PHP version constraints. Check the composer.json on Packagist or GitHub for the exact supported versions, and confirm compatibility with the spatie/laravel-health version your application uses. Treat the package's Composer constraints as the source of truth rather than assuming support from the README alone.
- How do I test the SecurityAdvisoriesCheck in my Laravel application?
- Test it through your existing Laravel Health test setup by asserting the check result and status rather than making real Packagist calls. Because the check can make outbound HTTP requests, use Laravel's HTTP fake or a cache-backed result in tests to avoid network flakiness. Also assert the meta payload if your notifications, dashboards, or stored history consume it, since that metadata is a trimmed contract.
- What are the production risks of relying on SecurityAdvisoriesCheck?
- It depends on Packagist uptime, latency, and advisory freshness, so a green result means no known advisory at the last successful sync, not an authoritative security attestation. The check's meta payload is a trimmed contract in 1.3.3, and downstream templates, dashboards, or log parsers that depend on removed Packagist fields can silently degrade; subclasses can use the protected $advisoryFieldsInMeta extension point if needed. For broader coverage, treat it as one signal alongside composer audit or dedicated SCA tooling rather than a replacement.
Weaver
How can I help you explore Laravel packages today?