Laravel Vet: Review Composer Packages Before Install | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ home ](https://msaied.com) [ articles ](https://msaied.com/articles) Laravel Vet: Review Composer Packages Before They Install On this page 1. [ What Is Laravel Vet? ](#what-is-laravel-vet) 2. [ Why This Matters Now ](#why-this-matters-now) 3. [ Installation ](#installation) 4. [ How the Review Flow Works ](#how-the-review-flow-works) 5. [ AI Agent Integration ](#ai-agent-integration) 6. [ The vet.json Format ](#the-vetjson-format) 7. [ Key Takeaways ](#key-takeaways) ![Laravel Vet: Review Composer Packages Before They Install](https://cdn.msaied.com/673/b28242efe2234ba0270b986e508570d2.png) [ Laravel ](https://msaied.com/articles?category=laravel) [ Composer Pacakge ](https://msaied.com/articles?category=composer-pacakge) #Laravel #Composer #Security #Supply Chain #Open Source Laravel Vet: Review Composer Packages Before They Install =========================================================== 15 Sep 2026 4 min read ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said Table of contents 1. [ 01 What Is Laravel Vet? ](#what-is-laravel-vet) 2. [ 02 Why This Matters Now ](#why-this-matters-now) 3. [ 03 Installation ](#installation) 4. [ 04 How the Review Flow Works ](#how-the-review-flow-works) 5. [ 05 AI Agent Integration ](#ai-agent-integration) 6. [ 06 The vet.json Format ](#the-vetjson-format) 7. [ 07 Key Takeaways ](#key-takeaways) What Is Laravel Vet? -------------------- Laravel Vet is an official package from the Laravel team that gives you a code-review gate between `composer update` and your `vendor/` directory. It ships as a Composer plugin, so it runs automatically after every install and before every update writes anything to disk. The concept is borrowed directly from `cargo vet` in the Rust ecosystem: every dependency update brings new code into your project, and Vet makes sure someone — or something — has read it first. Once you mark a package as trusted, Vet remembers it in a `vet.json` file. Future updates only surface what actually changed. A package that nobody has trusted causes Vet to exit with a non-zero status, which is exactly what you need to block an unreviewed dependency in CI. Vet works with any project that has a `composer.json` — Laravel, Symfony, WordPress, or plain PHP. Why This Matters Now -------------------- Every `composer update` silently writes thousands of lines of third-party code into your project. Most teams either audit diffs manually (rarely) or trust Packagist blindly (usually). Supply-chain incidents have made that second option increasingly risky: 2025 and 2026 have already seen malware-blocking policies land in Composer 2.10 and a remote-access trojan shipped inside a popular npm package. Laravel Vet adds a structured, repeatable review step that fits into your normal workflow. Installation ------------ Vet requires **PHP 8.4 or later**. Install it as a dev dependency and allow the Composer plugin when prompted: ```bash composer require laravel/vet --dev ``` Then trust everything currently in `vendor/` to create your baseline: ```bash ./vendor/bin/vet --init ``` This writes a `vet.json` file that records a version and a file-tree hash for each installed package. Commit this file to your repository. How the Review Flow Works ------------------------- When you run `composer update`, Vet intercepts the process and lists every package with changed files. If any package is untrusted, Composer exits with an error before writing anything: ```css ERROR [1] package is not trusted. Run [./vendor/bin/vet] in a terminal to pick the ones that you trust. ``` Run `./vendor/bin/vet` to open the interactive review. You can read the diffs yourself and press Space to select packages you trust, or you can let a coding agent do the first pass. ### AI Agent Integration Vet can hand each changed package to a coding agent already installed on your machine — Claude Code, Codex, Gemini, or opencode. The agent returns one of four verdicts: - **PASS** — review complete, no attack detected. - **FAIL** — a specific file and reason are reported (e.g., "reads `.env` and posts it to an unknown host"). - **WARN** — review is incomplete; a file may be too large, contain binary data, or the agent returned no answer. - **SKIP** — nothing changed or Vet could not read the package files. Vet pre-selects PASS packages. You review the rest, adjust the selection, and press Enter. The agent's verdict alone does not update `vet.json` — your explicit confirmation does. The vet.json Format ------------------- Each trusted entry stores a version and a hash derived from every file in the package: ```json { "schema": 4, "require": { "carbonphp/carbon-doctrine-types": { "version": "3.2.1", "hash": "tree-v2:0f158f3b909fc01e691ed5f5121186056232b049031e7d3a914676d49881ece5" } } } ``` If a package's files change without a version bump, the hash no longer matches and Vet requires a new review. Key Takeaways ------------- - Vet intercepts `composer update` before any files are written to `vendor/`. - `--init` bootstraps trust for all currently installed packages. - `vet.json` records version + file-tree hash; commit it to source control. - AI agents (Claude Code, Codex, Gemini, opencode) can pre-screen diffs for you. - A non-zero exit on untrusted packages makes Vet useful as a CI gate. - Vet is currently in beta; behavior may change before the stable release. - Works with Laravel, Symfony, WordPress, and any `composer.json` project. For full documentation visit the [Laravel Vet GitHub repository](https://github.com/laravel/vet). --- *Source: [Laravel News — Laravel Vet: Review Composer Code Before It Installs](https://laravel-news.com/laravel-vet)* Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fmsaied.com%2Farticles%2Flaravel-vet-review-composer-packages-before-they-install&text=Laravel+Vet%3A+Review+Composer+Packages+Before+They+Install) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fmsaied.com%2Farticles%2Flaravel-vet-review-composer-packages-before-they-install) Frequently Asked Questions ---------------------------- 3 questions Q01 What PHP version does Laravel Vet require? Laravel Vet requires PHP 8.4 or later. Q02 Does the AI agent's PASS verdict automatically update vet.json? No. The agent's verdict is advisory only. You must explicitly confirm your selection in the interactive terminal prompt before Vet writes anything to vet.json. Q03 Can Laravel Vet be used in a CI pipeline to block unreviewed packages? Yes. Vet exits with a non-zero status when any package is untrusted, which causes a CI build to fail until a developer reviews and approves the changes locally and commits the updated vet.json. Continue reading More Articles --------------- [ View all ](https://msaied.com/articles) [ ![Mercure Broadcasting in Laravel 13.32](https://cdn.msaied.com/672/f3bf9ae116410789061208a12ebf2682.png) Laravel Broadcasting Mercure ### Mercure Broadcasting in Laravel 13.32 Laravel 13.32 ships a native Mercure broadcast driver using SSE, new copyToDisk() and moveToDisk() filesystem... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 16 Sep 2026 3 min read Read ](https://msaied.com/articles/mercure-broadcasting-in-laravel-1332) [ ![What's New in PHP 8.6: Every Feature You Need to Know](https://cdn.msaied.com/671/4d84541d3dfb8c0d442b22cb158658ec.png) PHP 8.6 PHP New Features ### What's New in PHP 8.6: Every Feature You Need to Know PHP 8.6 lands on November 19, 2026, bringing partial function application, a clamp() function, a Duration clas... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 15 Sep 2026 3 min read Read ](https://msaied.com/articles/whats-new-in-php-86-every-feature-you-need-to-know) [ ![Livewire v4.4.5 Released: wire:navigate Fixes, JSON Session Support & More](https://cdn.msaied.com/670/91719b0682698004adbe722a8085269d.png) Livewire Laravel PHP ### Livewire v4.4.5 Released: wire:navigate Fixes, JSON Session Support & More Livewire v4.4.5 ships nine targeted fixes and backports, including JSON session serialization, improved wire:n... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 14 Sep 2026 3 min read Read ](https://msaied.com/articles/livewire-v445-released-wirenavigate-fixes-json-session-support-more) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://msaied.com) - [Projects](https://msaied.com/projects) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [Contact](https://msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)