beckenrode/dependency-sync

Report Laravel application Composer and npm dependencies to a Dependency Sync API.

v1.0.1 2026-08-19 14:41 UTC

Requires

• php: ^8.1
• composer-runtime-api: >=2.2
• illuminate/console: ^10.0|^11.0|^12.0|>=13.0
• illuminate/support: ^10.0|^11.0|^12.0|>=13.0

Requires (Dev)

• orchestra/testbench: ^8.0|^9.0|^10.0|>=11.0
• phpunit/phpunit: >=10.0

MIT

Published on Packagist.org on 2026-08-19 14:44 UTC

README

Reports a Laravel application's PHP version and installed Composer and npm package versions to a Dependency Sync API.

The package supports Laravel 10 and newer.

Install

composer require beckenrode/dependency-sync
php artisan vendor:publish --tag=dependency-sync-config

Add the credentials issued by your dependency sync API:

DEPENDENCY_SYNC_TOKEN=your-secret-token
DEPENDENCY_SYNC_ENDPOINT=https://dependencies.example/api/sync

Run manually

php artisan dependency-sync:report

The command sends a complete snapshot in this format:

{
    "php_version": "8.3.24",
    "composer": [{"name": "laravel/framework", "version": "v12.0.0"}],
    "npm": [{"name": "vite", "version": "6.0.0"}]
}

Composer packages are read from Composer's installed package metadata. npm packages are read from package-lock.json. When multiple installed npm versions share a package name, their versions are combined into one comma-separated value.

Schedule

Enable the package-managed schedule in .env:

DEPENDENCY_SYNC_SCHEDULE_ENABLED=true
DEPENDENCY_SYNC_SCHEDULE="0 * * * *"

The default cron expression reports hourly. Laravel's scheduler must also be running on the host, normally with this system cron entry:

* * * * * cd /path-to-app && php artisan schedule:run >> /dev/null 2>&1

Set DEPENDENCY_SYNC_TIMEOUT to change the HTTP timeout from its 30-second default.