Laravel Radar

Introduction

Laravel Radar is a lightweight dependency health dashboard and notifier for Laravel applications.

Radar scans Composer and NPM dependencies, stores a snapshot, and highlights:

• vulnerable packages
• outdated direct dependencies
• abandoned Composer packages
• practical, conservative next steps

Radar is intentionally read-only. It reports dependency health and suggests commands, but it does not update dependencies, edit lock files, commit changes, or deploy code for you.

Requirements

• PHP 8.3+
• Laravel 12 or 13
• Composer
• Node/NPM available when scanning JavaScript dependencies

Installation

Install Radar with Composer:

Publish Radar's config file, migration, and dashboard assets:

Run the migration:

Usage

Run a dependency scan:

Open the dashboard at:

The dashboard path can be changed with:

Radar's dashboard is enabled outside production by default and disabled in production by default. Production applications can still run scans and send notifications. Only enable the dashboard in production when it is protected by trusted authentication and authorization.

Commands

Radar currently ships these Artisan commands:

radar:scan

Scans application dependencies and stores a Radar snapshot.

Scan a different project path:

Use CI mode in a pipeline after installing dependencies:

The --ci flag makes radar:scan return a failing status when vulnerabilities meet the configured severity threshold. Your CI provider does not need special handling. It only needs to run the command and respect the exit code.

Set --severity to low, medium, high, or critical. Radar returns 1 when a vulnerability is at or above that threshold, 0 when none are, and 2 when the CI options or scan path are invalid.

radar:notify

Sends deduplicated vulnerability notifications for the latest stored scan.

Run a fresh scan before notifying:

Notifications are only sent when vulnerabilities exist and at least one notification route is configured.

radar:clear

Clears stored Radar scan history.

Skip the confirmation prompt:

Dashboard

The dashboard shows the latest stored scan, including:

• health score
• latest scan time
• Composer and NPM package inventory
• vulnerability findings
• outdated direct dependency findings
• abandoned Composer package findings
• suggested safe commands or review steps where Radar can infer them

Notifications

Radar uses Laravel Notifications. Your application still owns the normal mail and Slack transport configuration; Radar only stores the on-demand notification routes it should target.

Configure mail recipients:

Configure Slack:

Send notifications manually:

Or scan first, then notify:

Repeated notifications for the same vulnerability finding set are deduplicated for the configured TTL:

Scheduling

Radar preconfigures a nightly scheduled radar:notify --scan run at 02:00, so each notification run starts with a fresh scan.

Your application still needs Laravel's scheduler running in production, usually via a cron entry that runs php artisan schedule:run every minute.

Customize or disable Radar's built-in schedule:

Authorization

Radar checks the configured gate outside local environments before serving the dashboard.

Define the gate in your application, for example:

If you publish the config, you can change the gate name by editing the authorization.gate value in config/radar.php.

Configuration

Publish the configuration file with:

Useful environment variables:

See the configuration documentation for the full config reference.

Dependency sources

Radar reads dependency information from package manager files and installed package metadata.

Composer support includes:

• package inventory from composer.lock
• fallback inventory from vendor/composer/installed.json
• vulnerability findings from composer audit --format=json
• outdated direct dependencies from Composer's outdated output
• abandoned package metadata from Composer package data

NPM support includes:

• package inventory from package-lock.json
• fallback direct package inventory from node_modules/*/package.json
• vulnerability findings from npm audit --json
• outdated direct dependencies from NPM's outdated output

Supported Node runners

Radar detects the JavaScript package manager from the project lock file and uses that runner when suggesting safe NPM update commands.

If no known lock file exists, Radar falls back to npm.

Testing

Run the PHP checks:

Run frontend checks while working on dashboard assets:

License

Laravel Radar is open-sourced software licensed under the MIT license.