# Laravel Vet puts a trust gate in front of Composer dependency updates Laravel's experimental Vet tool brings a cargo-vet-style review boundary to Composer projects: package contents are hashed into a committed trust file, changed dependencies can be inspected before they land in vendor/, and CI fails while packages remain untrusted. Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision. - Status: Active - Published: 2026-09-17T21:26:47+12:00 - Updated: 2026-09-17T21:26:47+12:00 - Categories: Artificial Intelligence, Web Development, PHP, AI Coding, Developer Tools - Tags: Coding agents, Composer, dependency management, Laravel, supply chain security - Canonical HTML: https://beyondthe.news/dossiers/laravel-vet-composer-dependency-trust-gate ## What changed Laravel has published Vet, a work-in-progress Composer plugin that records trusted package versions and file-tree hashes in `vet.json`. On subsequent installs and updates, packages whose contents no longer match the trusted state are surfaced for review and can cause the command or CI build to fail until a human explicitly records trust. Vet can show package diffs before an update writes them into `vendor/`, and its interactive workflow can hand changed files to a locally installed coding agent such as Claude Code, Codex or Gemini for a PASS/FAIL/WARN review. The repository currently has no tagged release and explicitly warns that the tool is still a work in progress. ## Why it matters Composer normally verifies package distribution integrity but does not mean a team has reviewed what a newly released dependency actually changed. Vet adds a project-owned trust boundary around that step. A committed content hash can also detect changed package bytes even when the version string is unchanged, while a non-zero exit for untrusted dependencies makes the policy enforceable in CI. The coding-agent layer can reduce the amount of unfamiliar vendor code a developer has to inspect manually, but it does not make the dependency safe automatically: agent output does not alter the trust file until a human accepts the package. ## The trust record lives with the application `vet --init` creates `vet.json` beside `composer.json`, recording the version and a tree hash for packages already trusted by the project. Teams are expected to commit that file so the trust state is reviewable and shared rather than living only on one developer's machine. ## Composer updates can stop before untrusted code lands Vet ships as a Composer plugin. It audits installs and intercepts updates so changed or previously untrusted package contents can be reviewed before Composer writes the new files into `vendor/`. In non-interactive environments such as CI, an untrusted package produces a non-zero exit until the trust record is deliberately updated. ## Coding agents are reviewers, not approvers The interactive command can send changed package files to a locally installed coding agent and display PASS, FAIL, WARN or SKIP results. PASS packages may be selected by default, but the agent cannot write trust on its own; the developer still chooses which packages to accept. ## This is usable experimental tooling, not a stable Composer standard The repository says Vet is a work in progress and has no tagged release. It requires PHP 8.4 or later, and its behaviour and trust-file schema may still change. Builders evaluating it should treat the current version as an experiment and avoid confusing Laravel's implementation with a Composer-wide security guarantee. ## Key details - Laravel Vet is a Composer plugin intended to work with Laravel, Symfony, WordPress and plain PHP projects. - It records trusted dependency versions and file-tree hashes in a `vet.json` file intended to be committed to the repository. - Changed or untrusted package contents can be inspected before `composer update` writes them into `vendor/`. - Untrusted dependencies cause a non-zero exit, allowing the trust policy to gate CI. - Vet can ask locally installed coding agents to review changed package files and report PASS, FAIL, WARN or SKIP. - Agent results do not update the trust file automatically; a human chooses which packages to trust. - The project requires PHP 8.4 or later. - The repository currently warns that Vet is a work in progress and has no tagged release. ## Builder takeaways - Treat `vet.json` like other security-policy files: commit it, review changes to it in pull requests and do not let automated tooling silently approve new trust entries. - Use the CI failure as a deliberate dependency-review gate rather than bypassing it whenever an update is inconvenient. - Read agent FAIL and WARN results yourself and remember that a PASS is an automated review result, not proof that a dependency is safe. - For existing projects, understand that `vet --init` trusts the packages already present; it creates a baseline rather than retrospectively auditing everything you currently depend on. - Because Vet is pre-release, test it on non-critical projects or controlled CI paths before making it a hard production dependency. ## What to watch - A first tagged stable release and any changes to the `vet.json` schema or Composer-plugin behaviour. - Whether Composer or other PHP tooling adopts interoperable dependency-trust metadata rather than leaving Vet as a Laravel-led convention. - Evidence from real projects about review workload, false positives and whether agent-assisted review catches meaningful malicious or risky dependency changes. - How Vet interacts with Composer's own evolving package-security and supply-chain controls. ## Uncertainties - The project has no tagged release yet and explicitly describes itself as work in progress. - Automated coding-agent review quality depends on the selected agent, model and the code being inspected; Vet does not establish that PASS means safe. - Initialising an existing project records current packages as trusted without reviewing their historical provenance. ## Sources - [Laravel Vet](https://github.com/laravel/vet) — Laravel / GitHub · primary/repository · 2026-09-15T00:00:00+12:00. Primary implementation and documentation for trust hashing, Composer integration, CI behaviour, coding-agent review, PHP requirement and pre-release warning. - [Laravel Vet: Review Composer Code Before It Installs](https://laravel-news.com/laravel-vet) — Laravel News · specialist/independent · 2026-09-15T00:00:00+12:00. Specialist ecosystem explanation of the package's intended Composer supply-chain workflow and beta status.