- How do I install this PHPStan extension in a Laravel project?
- Run `composer require --dev wyrihaximus/phpstan-no-safe` in your Laravel project. Ensure PHPStan is already installed (`phpstan/phpstan`). No additional Laravel-specific setup is needed beyond configuring PHPStan’s ruleset.
- Will this break existing code using `thecodingmachine/safe` in Laravel?
- Yes, it will flag any usage of `safe` by default. You’ll need to whitelist specific classes or methods in your `phpstan.neon` file. Start with a broad whitelist for dependencies, then refine for custom code.
- Does this work with Laravel’s Artisan commands or shell operations?
- Absolutely. The extension detects unsafe shell operations (e.g., `shell_exec()`, `Artisan::call()` with dynamic arguments) and will raise violations unless explicitly whitelisted. Review your CLI-heavy commands first.
- What Laravel versions and PHP versions are supported?
- This package requires PHP 8.0+ and is compatible with Laravel 9+. It aligns with PHPStan’s minimum requirements, so ensure your Laravel app meets those before installing.
- Can I selectively disable this rule for third-party packages like `spatie/laravel-medialibrary`?
- Yes, use PHPStan’s `ignoreErrors` or `whitelist` configurations in `phpstan.neon` to exclude vendor packages. Test thoroughly, as some libraries may rely on `safe` internally.
- How does this integrate with Laravel’s dependency injection or service containers?
- The extension scans for dynamic method calls (e.g., `app()->make()` with unsafe parameters) or unsafe container interactions. If your app uses `safe` in service providers, you’ll need to whitelist those classes.
- Is there a performance impact in Laravel’s production environment?
- No. This is a static analysis tool—it only runs during development or CI/CD pipelines (e.g., GitHub Actions) and has zero runtime overhead in production.
- What if I need to use `safe` in a specific case, like legacy code or a microservice?
- Document the exception in your `phpstan.neon` file with a clear comment explaining why it’s necessary. For microservices, consider architectural alternatives like Laravel’s built-in abstractions (e.g., `Filesystem`) instead.
- Are there alternatives to this package for enforcing safe coding in Laravel?
- If you’re not using PHPStan, consider Psalm’s custom rules or Pest’s testing constraints. However, this package is the most direct way to block `safe` usage at analysis time in Laravel projects already using PHPStan.
- How do I add this to my Laravel CI/CD pipeline (e.g., GitHub Actions)?
- Add the extension to your `composer.json` dev dependencies, then run PHPStan in your workflow. Example: `phpstan analyse --level=max app --configuration=phpstan.neon`. No Laravel-specific steps are required beyond standard PHPStan setup.