Download the PHP package satheez/laravel-package-doctor without Composer

Laravel Package Doctor answers the question Composer alone does not:

Are the packages in this project healthy, safe, maintained, compatible, and worth keeping?

It scans your Composer dependencies, checks for security advisories, abandoned packages, Laravel and PHP compatibility, upgrade risk, license concerns, and repository health. It combines those signals into a scored report with actionable recommendations — instead of a raw list of version numbers.

The Problem

Before upgrading Laravel — or when inheriting a project — you need answers to questions like:

• Is this dependency still actively maintained?
• Does it support my target Laravel version?
• Is the latest version blocked by my composer.json constraint?
• Is a major breaking upgrade available that needs manual review?
• Which packages are abandoned, archived, or vulnerable?
• What should I update, replace, or investigate before going further?

Composer's built-in commands are powerful but narrow. They answer one question at a time. Package Doctor answers all of them together.

What Composer Gives You vs What Package Doctor Gives You

composer outdated tells you what changed:

Package Doctor tells you what it means:

For a genuinely problematic package:

Why This vs Other Tools

Use Dependabot / Renovate to automate routine version bumps. Use composer audit and Roave security-advisories as hard security gates. Use Package Doctor when you need to understand what your dependencies mean — before a Laravel upgrade, when inheriting a codebase, or when you want a scored risk report with recommendations instead of a list of raw diffs.

These tools are complementary. Package Doctor composes the data composer outdated, composer audit, and composer licenses produce into one coherent, scored decision layer.

Features

Scan

• Reads composer.json and composer.lock
• Detects direct, dev, and transitive dependencies
• Identifies installed and latest available versions
• Detects patch, minor, and major upgrade types

Detect

• Security advisories (composer audit)
• Abandoned packages (Packagist)
• Archived GitHub repositories
• Laravel and PHP version incompatibilities
• Constraint-blocked upgrades (latest version not installable)
• Packages with no recent release (12 or 18 month windows)
• Risky licenses (GPL, AGPL variants)
• Low-popularity packages

Score and Recommend

• 0–100 health score per package based on weighted deductions
• Status classification: Healthy, Watch, Risky, Critical
• One actionable recommendation per package
• Overall project health score
• Package ignore reasons that keep reviewed packages visible without affecting the project score
• Suggested replacements for abandoned packages when Composer or Packagist provides one
• Changelog links for major-upgrade recommendations when GitHub metadata is available

Output

• Readable console table with issue details
• Realtime terminal progress while scans are running
• Machine-readable JSON and CSV output (--json, --format=json, --format=csv)
• JSON and CSV file exports via --output=path
• Structured exit codes for CI (--ci)
• Offline mode that skips external API calls (--offline)
• Metadata caching to reduce API calls on repeated runs
• Project score trend indicators from the previous scan

Installation

Laravel auto-discovers the service provider. No manual registration needed.

Optional: Publish the config to customise scoring thresholds, CI gates, or package ignores:

Quick Start

Normal terminal runs show live scan progress while Composer, Packagist, and GitHub metadata are collected. Progress output is suppressed for JSON, CSV, CI, and non-interactive output so scripts can safely parse the final report.

Example output:

Output is illustrative. Actual formatting depends on your terminal width and installed packages.

Common Commands

All available options → docs/usage.md

Health Score

Each package starts at 100. Issues subtract points. Score is clamped to [0, 100].

All scoring is configurable. See docs/scoring.md.

CI/CD Integration

Full CI recipes for GitHub Actions, GitLab CI, and Bitbucket Pipelines → docs/ci.md

Configuration Snapshot

The most-tuned settings after publishing config/package-doctor.php:

Full config reference → docs/configuration.md

Ignored packages remain visible in the report with an Ignored status and the configured reason. They are excluded from the project score so known, reviewed exceptions do not inflate or reduce the health score.

Offline Mode

Skip all external API calls for restricted CI environments or air-gapped machines:

Offline mode still runs composer outdated, composer audit, and composer licenses, and reads your lock file. Packagist and GitHub checks are skipped.

GitHub Rate Limits

Large projects can exhaust GitHub's unauthenticated API limit because repository and release metadata are fetched per package. Add a token for a higher limit:

If GitHub reports a rate limit during a scan, Package Doctor skips further uncached GitHub calls for the rest of that run, keeps using cached metadata, and includes a single warning in the final report. Keep caching enabled, use --direct for focused scans, or set PACKAGE_DOCTOR_GITHUB_ENABLED=false when GitHub metadata is not needed.

Tip — avoiding rate limits: By default, Package Doctor scans your direct and dev dependencies only (no transitive packages). Laravel apps can have hundreds of transitive dependencies, so use --all deliberately when you need full tree coverage.

Trend History

Each scan writes the latest summary to storage/app/package-doctor-history.json when Laravel's storage directory is available. If not, it writes .package-doctor-history.json in the project base path. The next scan uses that file to show the previous project score and a trend indicator beside the current score.

Practical Use Cases

Before a Laravel upgrade

Identify every direct dependency that hasn't declared support for your target Laravel version.

Gate a production deployment

Fail the deploy pipeline if any production package is Critical.

Audit an inherited project

Get a picture of every dependency — including transitive packages — in a project you're taking over.

Weekly health check

Run on a schedule in CI. Store the JSON as an artifact or push it to a dashboard.

Clean up your dependency list

Focus only on packages that need attention without scrolling through the full list.

What This Does Not Do

• No auto-updates. It never modifies composer.json or runs composer update.
• No database required. All analysis is done at the CLI level.
• No dashboard in v1. Output is console or JSON only.
• Not a CVE database. Security advisory data comes from Packagist's advisory feed, which relies on composer audit.
• Not a replacement for reading changelogs. The score is a signal, not an absolute guarantee. Always review changelogs before major upgrades.

Roadmap

Documentation

Contributing

See CONTRIBUTING.md for development setup, testing conventions, and pull request guidelines.

Security

See SECURITY.md for the vulnerability reporting policy.

License

MIT — see LICENSE.md.