lombokclarion/phpstan-rules

PHPStan extension distributing LombokClarion's audit rules (§7): no interpolated/concatenated SQL into PDO query/prepare/exec, and no LombokClarion imports inside app/Domain.

Maintainers

Package info

github.com/codinglombok/phpstan-rules

Type:phpstan-extension

pkg:composer/lombokclarion/phpstan-rules

Transparency log

Statistics

Installs: 0

Dependents: 0

Suggesters: 1

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v2.1.0 2026-08-08 17:25 UTC

Requires

  • php: >=8.3

Suggests

  • phpstan/phpstan: ^1.11 || ^2.0 — only when installing PHPStan via Composer. The framework's own gate runs the pinned PHAR instead (see .github/workflows/ci.yml); the rules need nothing but class autoloading, so with the PHAR simply add `includes: vendor/lombokclarion/phpstan-rules/extension.neon` to your phpstan.neon. Keeping this out of `require` is what lets the package install in air-gapped / no-Packagist environments (U-S1-2).

Apache-2.0 dcf914075835c361a451aa1fd45bc1798b179e9d

Published on Packagist.org on 2026-08-09 00:51 UTC

This package is auto-updated.

Last update: 2026-08-09 13:12:28 UTC

README

PHPStan extension: SQL injection detection + domain boundary enforcement.

[READ-ONLY] This is a subtree split of the LombokClarion monorepo.
Do not send pull requests here — contribute to the main repository instead.

Install

composer require --dev lombokclarion/phpstan-rules

Include in phpstan.neon:

includes:
    - vendor/lombokclarion/phpstan-rules/extension.neon

Namespace

LombokClarion\PHPStanRules

What's Inside

Class Rule
NoRawSqlValuesRule Flags string concatenation and variable interpolation inside SQL query methods
DomainBoundaryRule Flags LombokClarion\ActiveRecord and LombokClarion\Facades imports in app/Domain/

License

Apache-2.0 — see LICENSE in the main repository.