proomt

Search

Search posts, papers, and topics

All posts

LaravelEric L. Barnes4 min readintermediate

Laravel Vet: Review Composer Code Before It Installs

Read on laravel-news.com

Summary

Laravel Vet is a Composer plugin that intercepts installs/updates, shows the diff of each package, and lets you approve changes manually or via an LLM‑based coding agent. Trusted packages are recorded in a `vet.json` with a content hash, so future updates only prompt for new changes. The tool exits with an error on untrusted code, making it CI‑friendly, and works with any PHP project using Compos…

  • Installs as a dev dependency (`composer require laravel/vet --dev`) and requires PHP 8.4+.
  • Run `./vendor/bin/vet --init` to seed `vet.json` with hashes of the current vendor tree.
  • During `composer update`, Vet pauses before writing files and prints a diff per package; you can approve with the space bar or hand off to an LLM (Claude, Gemini, etc.) that returns PASS/FAIL/WARN.
  • `vet.json` stores version + a Merkle‑style hash of every file; any change—even without a new version—forces a re‑review.

Supply‑chain attacks in the PHP ecosystem are rising; Vet gives teams a low‑friction way to audit new code before it lands, leveraging existing LLM agents for quick triage while keeping a deterministic trust record.

5/10
devopssecurityphplaravelcomposersupply chain

Related reading

  2. Laravel Scalpel Scans for Filesystem Intrusion Evidence

    Laravel Scalpel is a Laravel‑native scanner that looks for post‑deployment filesystem tampering – rogue PHP files, obfuscated backdoors, altered .htaccess/.user.ini, missing or mis‑configured .env, and diffs against a signed baseline. It ships with six built‑in scanners, baseline snapshot commands, fast vs strict hashing modes, CI‑friendly output (JSON, SARIF, GitHub annotations) and a ScanFinish…

    Laravellaravel-news.com5 min

  3. Building Sentry's Laravel AI Integration

    Sentry added zero‑config Agent Tracing for Laravel AI agents. The integration hooks into Laravel AI events and HTTP request events to create Chat spans for each LLM call, matching requests by provider URL prefix. Updating to sentry‑laravel 4.27 automatically instruments agents without any user code changes.

    Sentrysentry.io4 min

  4. Introducing the DevOps Agent Kit

    The DevOps Agent Kit is an Apache‑2.0 open‑source starter kit that lets you plug an LLM‑based coding assistant into your existing CI/CD, security, and feature‑flag tooling via CloudBees Unify. It ships with seven read‑only example skills, enforces RBAC and audit trails, and normalises data from up to 63 tools so the agent can answer a single “are we good to ship?” question with verifiable evidenc…

    Codeshipcloudbees.com5 min

  5. Mercure Broadcasting in Laravel 13.32

    Laravel 13.32.0 adds a Mercure broadcast driver (SSE‑based real‑time), new FilesystemAdapter methods copyToDisk()/moveToDisk() for cross‑disk file moves, and enum support in Queue pause/resume APIs. Minor tweaks include default Cloud exit codes, collection return‑type fixes, and Mercure installer integration.

    Laravellaravel-news.com3 minrelease