Laravel Vet

Introduction

vet is a dependency audit for PHP. It shows you what a composer update is about to put into the vendor/ directory, and lets you or your agent review those changes, one by one, before they land.

❯ composer update

  to review (1, worst first)

  carbonphp/carbon-doctrine-types 3.1.0 → 3.2.0  2 files to review (delta from 3.1.0)
      composer would install these bytes; you trust 3.1.0  ·  8.0 KB

  runtime source (2)
    ~ src/Carbon/Doctrine/DateTimeImmutableType.php
      @@ -17,7 +17,7 @@
           /**
            * @SuppressWarnings(PHPMD.UnusedFormalParameter)
            */
      -    public function convertToPHPValue(mixed $value, AbstractPlatform $platform): ?DateTimeImmutable
      +    public function convertToPHPValue(mixed $value, AbstractPlatform $platform): ?CarbonImmutable
           {
               return $this->doConvertToPHPValue($value);
           }

    ~ src/Carbon/Doctrine/DateTimeType.php
      @@ -17,7 +17,7 @@
           /**
            * @SuppressWarnings(PHPMD.UnusedFormalParameter)
            */
      -    public function convertToPHPValue(mixed $value, AbstractPlatform $platform): ?DateTime
      +    public function convertToPHPValue(mixed $value, AbstractPlatform $platform): ?Carbon
           {
               return $this->doConvertToPHPValue($value);
           }


  audited .................................................. 124 / 125 (99.2%)

   ERROR  1 package(s) are not covered. Read every change with `composer update -v`, then record them with `vet trust`.

Installation

Requires PHP 8.3+.

You may install vet into your project via the Composer package manager:

composer require laravel/vet --dev

By default, vet commands are invoked using the ./vendor/bin/vet script that is included with the package:

./vendor/bin/vet audit

Trusting Your Dependencies

Before vet can show you what changed, it needs to know what you trust today. The trust command lists every installed package with the reason it needs an entry, records the tree on disk, and writes the vet.json trust file:

vet trust

  to trust (125)

  brianium/paratest v7.24.0 (dev) ........ no entry; this tree is 3629153db155
  brick/math 0.18.0 ...................... no entry; this tree is 2874e68aa900
  carbonphp/carbon-doctrine-types 3.2.0 .. no entry; this tree is ad33848c07e8
  …

   INFO  Trusted 125 package(s), and wrote vet.json.

Auditing Your Dependencies

Once the trust file exists, run the audit command whenever you want to know where you stand. It reports the packages that have no entry:

vet audit

   INFO  All 125 packages are covered.

Auditing a Single Package

You may audit one package by passing its name to the audit command:

vet audit symfony/console

  symfony/console .................................................... v7.4.16
  hash .............................. tree-v1:6bcaeda34b1df22209a4ea023cf74641
  source ................................................................ dist
  contents ............................................... 140 files, 618.2 KB
  path ................................................ vendor/symfony/console

When the trust file already covers the installed version, the report stays local and instant. When the trust file holds an earlier version, vet fetches that version from Packagist and shows you the delta. If you would like to compare against some other version, you may name it using the --from option:

vet audit carbonphp/carbon-doctrine-types --from=3.1.0

The Trust File

The trust file lives in vet.json, at the root of your project, next to composer.json. You should commit it. It holds one entry for each package: the version you reviewed, and the hash of the tree you reviewed.

{
    "schema": 3,
    "require": {
        "carbonphp/carbon-doctrine-types": {
            "version": "3.2.0",
            "hash": "tree-v1:ad33848c07e8c0d58a0f9011341684a2"
        }
    },
    "require-dev": {
        "brianium/paratest": {
            "version": "v7.24.0",
            "hash": "tree-v1:3629153db155b72b307e76e1d79c0b30"
        }
    }
}

Continuous Integration

Your build audits your dependencies the moment it installs them. vet ships a Composer plugin, and the plugin runs the audit after every composer install, and again before composer update writes anything into vendor/. There is no step to add.

Contributing

Thank you for considering contributing to Laravel! The contribution guide can be found in the Laravel documentation.

Code of Conduct

In order to ensure that the Laravel community is welcoming to all, please review and abide by the Code of Conduct.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

License

The Laravel AI SDK is open-sourced software licensed under the MIT license.