Laravel Vet puts a trust gate in front of Composer dependency updates

Laravel has published Vet, a work-in-progress Composer plugin that records trusted package versions and file-tree hashes in `vet.json`. On subsequent installs and updates, packages whose contents no longer match the trusted state are surfaced for review and can cause the command or CI build to fail until a human explicitly records trust. Vet can show package diffs before an update writes them into `vendor/`, and its interactive workflow can hand changed files to a locally installed coding agent such as Claude Code, Codex or Gemini for a PASS/FAIL/WARN review. The repository currently has no tagged release and explicitly warns that the tool is still a work in progress.

Composer normally verifies package distribution integrity but does not mean a team has reviewed what a newly released dependency actually changed. Vet adds a project-owned trust boundary around that step. A committed content hash can also detect changed package bytes even when the version string is unchanged, while a non-zero exit for untrusted dependencies makes the policy enforceable in CI. The coding-agent layer can reduce the amount of unfamiliar vendor code a developer has to inspect manually, but it does not make the dependency safe automatically: agent output does not alter the trust file until a human accepts the package.

`vet --init` creates `vet.json` beside `composer.json`, recording the version and a tree hash for packages already trusted by the project. Teams are expected to commit that file so the trust state is reviewable and shared rather than living only on one developer's machine.

Vet ships as a Composer plugin. It audits installs and intercepts updates so changed or previously untrusted package contents can be reviewed before Composer writes the new files into `vendor/`. In non-interactive environments such as CI, an untrusted package produces a non-zero exit until the trust record is deliberately updated.

The interactive command can send changed package files to a locally installed coding agent and display PASS, FAIL, WARN or SKIP results. PASS packages may be selected by default, but the agent cannot write trust on its own; the developer still chooses which packages to accept.

The repository says Vet is a work in progress and has no tagged release. It requires PHP 8.4 or later, and its behaviour and trust-file schema may still change. Builders evaluating it should treat the current version as an experiment and avoid confusing Laravel's implementation with a Composer-wide security guarantee.