Laravel Vet: Review Composer Packages Before They Install

What Is Laravel Vet?

Laravel Vet is an official package from the Laravel team that gives you a code-review gate between composer update and your vendor/ directory. It ships as a Composer plugin, so it runs automatically after every install and before every update writes anything to disk. The concept is borrowed directly from cargo vet in the Rust ecosystem: every dependency update brings new code into your project, and Vet makes sure someone — or something — has read it first.

Once you mark a package as trusted, Vet remembers it in a vet.json file. Future updates only surface what actually changed. A package that nobody has trusted causes Vet to exit with a non-zero status, which is exactly what you need to block an unreviewed dependency in CI.

Vet works with any project that has a composer.json — Laravel, Symfony, WordPress, or plain PHP.

Why This Matters Now

Every composer update silently writes thousands of lines of third-party code into your project. Most teams either audit diffs manually (rarely) or trust Packagist blindly (usually). Supply-chain incidents have made that second option increasingly risky: 2025 and 2026 have already seen malware-blocking policies land in Composer 2.10 and a remote-access trojan shipped inside a popular npm package.

Laravel Vet adds a structured, repeatable review step that fits into your normal workflow.

Installation

Vet requires PHP 8.4 or later. Install it as a dev dependency and allow the Composer plugin when prompted:

composer require laravel/vet --dev

Then trust everything currently in vendor/ to create your baseline:

./vendor/bin/vet --init

This writes a vet.json file that records a version and a file-tree hash for each installed package. Commit this file to your repository.

How the Review Flow Works

When you run composer update, Vet intercepts the process and lists every package with changed files. If any package is untrusted, Composer exits with an error before writing anything:

ERROR  [1] package is not trusted.
Run [./vendor/bin/vet] in a terminal to pick the ones that you trust.

Run ./vendor/bin/vet to open the interactive review. You can read the diffs yourself and press Space to select packages you trust, or you can let a coding agent do the first pass.

AI Agent Integration

Vet can hand each changed package to a coding agent already installed on your machine — Claude Code, Codex, Gemini, or opencode. The agent returns one of four verdicts:

• PASS — review complete, no attack detected.
• FAIL — a specific file and reason are reported (e.g., "reads .env and posts it to an unknown host").
• WARN — review is incomplete; a file may be too large, contain binary data, or the agent returned no answer.
• SKIP — nothing changed or Vet could not read the package files.

Vet pre-selects PASS packages. You review the rest, adjust the selection, and press Enter. The agent's verdict alone does not update vet.json — your explicit confirmation does.

The vet.json Format

Each trusted entry stores a version and a hash derived from every file in the package:

{
    "schema": 4,
    "require": {
        "carbonphp/carbon-doctrine-types": {
            "version": "3.2.1",
            "hash": "tree-v2:0f158f3b909fc01e691ed5f5121186056232b049031e7d3a914676d49881ece5"
        }
    }
}

If a package's files change without a version bump, the hash no longer matches and Vet requires a new review.

Key Takeaways

• Vet intercepts composer update before any files are written to vendor/.
• --init bootstraps trust for all currently installed packages.
• vet.json records version + file-tree hash; commit it to source control.
• AI agents (Claude Code, Codex, Gemini, opencode) can pre-screen diffs for you.
• A non-zero exit on untrusted packages makes Vet useful as a CI gate.
• Vet is currently in beta; behavior may change before the stable release.
• Works with Laravel, Symfony, WordPress, and any composer.json project.

For full documentation visit the Laravel Vet GitHub repository.

Source: Laravel News — Laravel Vet: Review Composer Code Before It Installs