README

Reports a Laravel site's stack to Soilboard, which judges the packages against Packagist security advisories and tells you which are outdated.

Every installed package is reported, including dependencies of dependencies: a vulnerability in one of those runs in production just the same. Each package says whether the site's own composer.json requires it (is_direct), so Soilboard only calls direct packages outdated.

Requirements

PHP 8.1 or newer
Laravel 10, 11, 12 or 13
A Soilboard licence key, with the site added in Soilboard as a website with platform Laravel

Install

composer require mediasoep/soilboard-laravel

Configure

SOILBOARD_LICENSE=your-licence-key

That is all a site on its APP_URL needs. Optional:

Variable	Default	Meaning
`SOILBOARD_SITE_URL`	`APP_URL`	The url the licence is registered under, when it differs from `APP_URL` (other scheme, `www`, a subpath).
`SOILBOARD_ENABLED`	on in `production` only	`true` or `false` to override, so a staging or local copy never reports as the live site.
`SOILBOARD_SCHEDULE`	`true`	`false` skips the daily run.
`SOILBOARD_REPORT_AFTER_COMPOSER`	`true`	`false` skips the report after a Composer autoload dump (`composer install`, `update`, `require`, …).
`SOILBOARD_URL`	`https://soilboard.nl`	Another Soilboard, such as a local one. Use https: over http the licence key travels unencrypted, even when the server redirects to https. A redirect is followed as a POST only on the same host (with or without `www`), at most twice and never from https to http; any other redirect is refused (`redirect_refused`).

Publish the config with php artisan vendor:publish --tag=soilboard-config.

Run

Daily at a fixed minute between 03:00 and 03:59 (the same minute for a site every day), through the Laravel scheduler.
After every Composer autoload dump (composer install, update, require, remove and dump-autoload): Laravel's composer.json runs php artisan package:discover afterwards, and the package reports when that finishes. A site whose composer.json no longer runs package:discover, or a run with --no-scripts, skips it. Composer waits for the report: up to the timeout in the config (10 seconds) when Soilboard is slow or unreachable, and as long again for each redirect it follows. A build that runs composer install with APP_ENV=production and the licence set (a Docker image, a CI build) reports from there; set SOILBOARD_REPORT_AFTER_COMPOSER=false in that build.
After a deploy: php artisan soilboard:report. It always exits 0, so a Soilboard outage never stops a deploy; add --strict to exit 1 when the report was not accepted.
Check the install: php artisan soilboard:report --force. stored or skipped means it works. invalid means the url does not match the licence. wrong_platform means the website is not set to Laravel in Soilboard.

Reporting never throws into your application, its scheduler or a deploy: a failure is logged as a warning and reported as a status.

What is sent

One JSON snapshot to {SOILBOARD_URL}/api/v1/laravel/snapshots, with the licence key and the site url:

the Laravel and PHP version and APP_ENV
this package's version
every installed Composer package: name, version, whether it is a dev dependency and whether the site's composer.json requires it directly (at most 1000; dev packages are dropped first)
every npm package in package-lock.json (lockfile version 2 or 3, npm 7 and later): name, version, every other installed version, whether it is a dev dependency and whether the site's package.json or one of its workspaces requires it directly (at most 2000; the site's own packages are kept first). Dev dependencies are sent too: in a Laravel app the libraries Vite bundles for visitors are usually dev dependencies. A package installed in several versions is one entry: the top-level version (or the lowest nested one) plus the others, so Soilboard checks every copy for vulnerabilities. Without a package-lock.json an empty list is sent; an older or unreadable lockfile sends none, and Soilboard keeps what it knew.

Nothing else: no code, no .env values, no data from your database.

Development

composer install
vendor/bin/phpunit

Releases follow the same two steps as SOIL. Add your changes under ## Unreleased in CHANGELOG.md, then:

npm install
npm run release        # runs the tests, asks for the version, dates the changelog
node post-release.mjs  # commits the changelog, tags vX.Y.Z and offers to push

Packagist picks the new tag up from GitLab.

License

MIT. See LICENSE.

mediasoep / soilboard-laravel

Package info

Security

Statistics