Weave Code
Phpstan Safe Rule Laravel Package
thecodingmachine/phpstan-safe-rule
PHPStan rule set that flags calls to “unsafe” PHP functions that can return false on failure and suggests using the thecodingmachine/safe equivalents that throw exceptions, helping enforce safer, exception-based error handling in your codebase.
A PHPStan rule to be used with the thecodingmachine/safe package
Frequently asked questions about Phpstan Safe Rule
- How do I install thecodingmachine/phpstan-safe-rule in a Laravel project?
- Run `composer require --dev thecodingmachine/phpstan-safe-rule thecodingmachine/safe` to install both the rule and its dependency. Configure PHPStan by adding `includes: - vendor/thecodingmachine/phpstan-safe-rule/extension.neon` to your `phpstan.neon` file. Ensure PHPStan 2.0+ and PHP 8.1+ are already in use.
- Will this package work with Laravel’s Eloquent or Blade templates?
- Yes, but you may need to exclude Laravel’s core functions or Blade-compiled code. Use `ignoreErrors: - '#.*vendor/laravel.*#'` in `phpstan.neon` to skip Laravel’s unsafe calls. For Blade, add `@phpstan-ignore-line` annotations to dynamic code blocks like `@php`.
- What Laravel versions and PHPStan versions are supported?
- This package requires **PHP 8.1+** and **PHPStan 2.0+**. Laravel 10+ is fully compatible, but Laravel 9.x may need manual adjustments due to PHPStan 1.x limitations. Always check your Laravel version’s PHPStan baseline before adoption.
- How do I avoid false positives in Laravel-specific code (e.g., Str::* helpers)?
- Start with `level: 1` in `phpstan.neon` to reduce strictness. Explicitly ignore Laravel’s unsafe functions with `ignoreErrors: - '#.*Str::.*#'` or suppress warnings per-line using `@phpstan-ignore-next-line`. Test incrementally with a subset of your codebase.
- Can I use this without thecodingmachine/safe package?
- No, this rule **requires** `thecodingmachine/safe` to function. It flags unsafe functions and suggests replacing them with `thecodingmachine/safe` equivalents. Install both packages simultaneously for full compatibility.
- Does this package slow down Laravel’s runtime or CI/CD pipelines?
- No runtime impact exists—this is a **static analysis tool** run during development or CI. PHPStan adds ~1–5% overhead to your CI pipeline, but it’s negligible for most Laravel projects (<1M LOC). Optimize by running it in parallel or caching results.
- How do I configure PHPStan to ignore specific unsafe functions in my Laravel app?
- Edit `phpstan.neon` to exclude patterns like `ignoreErrors: - '#.*preg_match.*#'` or use inline annotations: `// @phpstan-ignore-next-line`. For Laravel’s core, use `ignoreErrors: - '#.*vendor/laravel/framework.*#'` to suppress false positives.
- Are there alternatives to this package for Laravel’s null-safety needs?
- Yes, consider **custom PHPStan rules** (e.g., `phpstan/extension-installer`) or Laravel-specific tools like `spatie/laravel-phpstan-rules`. However, `thecodingmachine/safe` + this rule is the most integrated solution for enforcing exception-based error handling.
- How do I test this package before full adoption in a Laravel project?
- Start with a **dev container** or branch. Run `phpstan analyse --memory-limit=1G app/Http` on a subset of your code. Use `level: 1` to minimize false positives. Monitor CI/CD integration by adding `phpstan analyse` to your workflow with `exit-code: 1` for errors.
- What happens if thecodingmachine/phpstan-safe-rule stops being maintained?
- The package is tied to `thecodingmachine/safe`, which is actively maintained. If maintenance stalls, you can **fork the rule** or migrate to alternatives like `phpstan/extension-installer` with custom rules. Always check the last release date (2026-06-23) for updates.
Weaver
How can I help you explore Laravel packages today?