Looking to hire Laravel developers? Try LaraJobs

soilboard-laravel maintained by mediasoep

Description
Reports a Laravel site's stack to Soilboard.
Author
Arjen de Jong
Last update
2026/10/14 13:29 (dev-main)
License
MIT
Links
Homepage - GitLab - Packagist
Downloads
16
Tags
security - composer - maintenance - laravel - soilboard

dev-main

Last update
2026/10/14 13:29
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
v1.1.3

Last update
2026/10/14 13:29
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
v1.1.2

Last update
2026/10/13 17:03
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
v1.1.1

Last update
2026/10/13 16:09
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
v1.1.0

Last update
2026/10/13 15:58
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
v1.0.0

Last update
2026/10/12 17:53
License
MIT
Require
  • php ^8.1
  • composer-runtime-api ^2.1
  • illuminate/console ^10.0|^11.0|^12.0|^13.0
  • illuminate/http ^10.0|^11.0|^12.0|^13.0
  • illuminate/support ^10.0|^11.0|^12.0|^13.0
Comments
comments powered by Disqus

soilboard-laravel

Reports a Laravel site's stack to Soilboard, which judges the packages against Packagist security advisories and tells you which are outdated.

Every installed package is reported, including dependencies of dependencies: a vulnerability in one of those runs in production just the same. Each package says whether the site's own composer.json requires it (is_direct), so Soilboard only calls direct packages outdated.

Requirements

  • PHP 8.1 or newer
  • Laravel 10, 11, 12 or 13
  • A Soilboard licence key, with the site added in Soilboard as a website with platform Laravel

Install

composer require mediasoep/soilboard-laravel

Configure

SOILBOARD_LICENSE=your-licence-key

That is all a site on its APP_URL needs. Optional:

Variable Default Meaning
SOILBOARD_SITE_URL APP_URL The url the licence is registered under, when it differs from APP_URL (other scheme, www, a subpath).
SOILBOARD_ENABLED on in production only true or false to override, so a staging or local copy never reports as the live site.
SOILBOARD_SCHEDULE true false skips the daily run.
SOILBOARD_URL https://www.soilboard.nl Another Soilboard, such as a local one. Use the https base url: an http url that redirects turns the POST into a GET.

Publish the config with php artisan vendor:publish --tag=soilboard-config.

Run

  • Daily at a fixed minute between 03:00 and 03:59 (the same minute for a site every day), through the Laravel scheduler.
  • After a deploy: php artisan soilboard:report. It always exits 0, so a Soilboard outage never stops a deploy; add --strict to exit 1 when the report was not accepted.
  • Check the install: php artisan soilboard:report --force. stored or skipped means it works. invalid means the url does not match the licence. wrong_platform means the website is not set to Laravel in Soilboard.

Reporting never throws into your application, its scheduler or a deploy: a failure is logged as a warning and reported as a status.

What is sent

One JSON snapshot to {SOILBOARD_URL}/api/v1/laravel/snapshots, with the licence key and the site url:

  • the Laravel and PHP version and APP_ENV
  • this package's version
  • every installed Composer package: name, version, whether it is a dev dependency and whether the site's composer.json requires it directly (at most 1000; dev packages are dropped first)

Nothing else: no code, no .env values, no data from your database.

Development

composer install
vendor/bin/phpunit

Releases follow the same two steps as SOIL. Add your changes under ## Unreleased in CHANGELOG.md, then:

npm install
npm run release        # runs the tests, asks for the version, dates the changelog
node post-release.mjs  # commits the changelog, tags vX.Y.Z and offers to push

Packagist picks the new tag up from GitLab.

License

MIT. See LICENSE.