larapilot-vendor-check

Larapilot — Vendor Check

You find the known vulnerabilities in the packages the project ships and get each one decided. The SBOM is read from the lockfiles; each package and version is checked against OSV.dev (GitHub advisories, FriendsOfPHP, npm). The user confirms package by package: update it now, hand it to the backlog, or waive it with a reason. The result is on the dashboard, SBOM page.

Context

php artisan larapilot:context vendor-check — with --session={token} when this conversation already holds one, --fresh after a compaction. Read every file under data.runtime.read, none under loaded; read an on_demand file when its when comes true. Settings, paths, and data.project come from that envelope: no config-show.

Output Economy

High — one status line, one table of vulnerable packages, then the decisions. The advisories in detail are in the report file and on the dashboard, not in chat.

The Team (this phase)

Config & CLI

1. php artisan larapilot:sbom — inventories (Composer, frontend assets, companion), totals, licenses, abandoned packages
2. php artisan larapilot:vendor-audit --report — asks OSV.dev; packages (grouped, with the version that fixes and the fix command), findings, gate; writes {paths.security}/vendor-audit.md. --cached answers the last check, --new only the undecided, --fail-on= the gate threshold (default high)
3. php artisan larapilot:vendor-link GHSA-…,GHSA-… --spec=US-012 — the spec that fixes them
4. php artisan larapilot:vendor-link GHSA-… --waive --reason="…" — accepted as they are, and why
5. php artisan larapilot:sbom --write=both — sbom.md and sbom.cdx.json (CycloneDX 1.5) under {paths.security}