Changelog

Added

• •DetectsErrorTracking shares the error-tracking package list, now including Flare, Inspector and Nightwatch (#494)

Fixed

• •missing-error-tracking no longer passes on a tracker installed only under require-dev (#494)
• •asset-cache-headers warns about an asset it could not fetch, instead of failing at High (#495)
• •asset-cache-headers probes assets under app.asset_url or app.mix_url rather than app.url (#495)

Added

• •OriginReachabilityChecker takes an optional ProbeRequest, so a probe can send Accept-Encoding and keep the origin's Content-Encoding (#488)

Changed

• •login-throttling reports each unthrottled login route in routes/auth.php, replacing the single file-level Breeze or Jetstream finding (#483, #491)

Fixed

• •login-throttling ignores commented-out code, so a commented-out route or throttle no longer changes the result (#482)
• •login-throttling scans routes/web.php, which every install registers in the web group, so an unthrottled POST /login is reported (#483)
• •login-throttling no longer lets an api-group throttle, such as the stock throttle:api, clear web login routes or skip the Fortify check (#483)
• •login-throttling no longer reports a login controller whose route carries throttle middleware or whose FormRequest throttles, such as $request->authenticate() (#484, #486)
• •login-throttling reads a route's throttle to the end of its statement, so a one-line route no longer borrows the next route's throttle (#490)
• •login-throttling credits a login route only with its own controller's or middleware's throttling, so a throttled web controller no longer hides an unthrottled API route (#491)
• •login-throttling detects a login route chained after another call, such as Route::middleware('guest')->post() (#491)
• •login-throttling no longer reports Fortify without a limiters config or after Fortify::ignoreRoutes(), since neither leaves an unthrottled Fortify login route (#491)
• •login-throttling checks Fortify even when the app calls RateLimiter itself, and reports a login pipeline that leaves out EnsureLoginIsNotThrottled (#491)

Added

• •The report lists files the parser could not read under parse_failures, and the console warns that a pass does not cover them (#457)
• •The report includes parser_compatibility, and the console warns when the installed php-parser is older than the running PHP (#457)
• •phpstan reports declarations PHP refuses to compile, such as a colliding import, under a new Critical compile-errors category (#474)
• •phpstan reports every used void result under a new High used-void-result category, rather than as Critical or High by call type (#479)

Changed

• •Requires shieldci/analyzers-core ^2.8 (was ^2.6), for parse-failure reporting (#457)
• •chunk-missing no longer exempts a fetch because its select uses DB::raw() (#458)
• •service-container-resolution names an enum it reports, such as App\Enums\Status::label, rather than Unknown::label (#454)
• •service-container-resolution names an anonymous class such as LabelService@anonymous::label, rather than a non-existent App\Services\Anonymous::label (#454)
• •missing-database-transactions names an anonymous class after its resolved parent, such as App\Support\Handler@anonymous (#470)
• •phpstan reports compile errors and used void results as Compile Errors detected and Used Void Results detected, so a baselined row is reported once more (#474, #479)

Fixed

• •chunk-missing no longer flags a fetch bounded by a key list, such as whereIn('id', $ids), unless the list is a subquery (#458, #471)
• •chunk-missing no longer flags a fetch grouped only by columns its whereIn() or where() filters pin, since it returns one row per combination (#458)
• •chunk-missing reports a loop over a fetch captured by a closure's use (#454)
• •missing-database-transactions tells apart same-named methods of different classes in one file (#466)
• •missing-database-transactions no longer treats a helper as protected when only a class declared inside DB::transaction() calls it (#454)
• •mixed-query-builder-eloquent no longer drops a file with two imports on one alias and reports a pass (#452)
• •mixed-query-builder-eloquent counts connection-qualified writes and further write methods, such as updateFrom(), against its withoutGlobalScope() exemption (#460)
• •mixed-query-builder-eloquent keeps a table reported as mixed after a later query-builder read (#464)
• •authentication-authorization no longer errors on a file with two imports on one alias (#463)
• •service-container-resolution and missing-docblock no longer error on a file with two imports on one alias (#473)
• •framework-override, fat-model and logic-in-routes no longer skip a file with two imports on one alias (#473)
• •eloquent-n-plus-one recognises a model referenced in a different case, such as product::get() (#465)
• •eloquent-n-plus-one flags a relationship registered through parent::resolveRelationUsing() (#468)
• •fillable-foreign-key and mass-assignment-vulnerabilities recognise a model whose parent is a relative name, such as Catalog\Record (#467)
• •phpstan fails the build and lists the files under stopped_at when PHPStan stops at a file it cannot parse or reflect, instead of warning (#474, #478)
• •collection-call-optimization returns an error instead of a pass when PHPStan stops at a file (#474)

Changed

• •Issue messages name an anonymous class the way PHP does, such as Migration@anonymous, rather than Unknown (#435)

Fixed

• •missing-database-transactions recognises DB::connection(...)->transaction() and a fully qualified or aliased DB::transaction() (#421, #446)
• •missing-database-transactions no longer counts a cache, filesystem or queue client call as a database write, including one declared on a parent or trait (#421, #427, #441)
• •chunk-missing no longer reports a facade read such as Cache::get() as an unchunked query (#421)
• •eloquent-n-plus-one, chunk-missing and missing-database-transactions no longer exempt an app model named like a facade, such as App\Models\Event (#424, #428, #436, #446)
• •missing-database-transactions, missing-docblock, service-container-resolution, mixed-query-builder-eloquent and chunk-missing analyze a method correctly when it declares a nested class (#435)
• •eloquent-n-plus-one inherits a parent model's relationships when extends uses different case or a relative name (#448)
• •mixed-query-builder-eloquent tracks a model assigned through an imported name, such as $query = User::query() (#439)

Added

• •OriginReachabilityChecker probes each origin the app declares once and names the outcome, so an unreachable host cannot read as a clean result (#404)

Changed

• •env-http-accessibility verifies TLS certificates on its probes, so a staging origin with a self-signed certificate warns rather than passing (#408)
• •Requires shieldci/analyzers-core ^2.6 (was ^2.5), for the shared AST parser every analyzer now resolves through (#412)

Fixed

• •logic-in-blade and eloquent-n-plus-one analyze Blade views containing a multi-line directive, an inline @php, a @switch or a raw <?php tag, rather than skipping them and reporting a pass (#407, #409, #413, #414, #416)
• •logic-in-blade no longer reports blade-unclosed-php-block for a @php that is not a directive, such as one written in prose or inside {{-- --}} (#414)
• •logic-in-blade no longer reports blade-inline-php for a <?php occurring inside a @php block body, such as one in a string or heredoc (#416)
• •env-http-accessibility warns when a location produced no response, instead of reporting the web server properly configured from zero replies (#408)

Changed

• •Requires shieldci/analyzers-core ^2.5 (was ^2.3), so a failed analyzer's stack trace no longer records each frame's arguments (#398)

Fixed

• •method-length no longer loses a method's declarative exemption to a leading assignment or a trailing comment (#394)
• •method-length exempts up to 15 declarative statements rather than 5, so six RateLimiter::for() blocks are no longer flagged (#394)
• •An analyzer that catches its own failure truncates and redacts the message, so database-status no longer reports a raw PDO error (#401)

Fixed

• •phpstan and collection-call-optimization run on projects that require a newer PHP than the php first on PATH, instead of aborting with "PHPStan produced no analysable output" (#390)

Fixed

• •logic-in-blade, csrf-protection and xss-vulnerabilities honour excluded_paths when scanning Blade views and JavaScript files (#385)
• •unused-global-middleware and cookie name the middleware file the project actually has, app/Http/Kernel.php or bootstrap/app.php, instead of choosing by Laravel version or naming a file that is not there (#387)
• •phpstan and collection-call-optimization run on projects whose phpstan.neon or phpstan/extension-installer already loads Larastan, instead of aborting with "This file is included multiple times" (#388)

Added

• •report.snippet_plain_mode and report.snippet_syntax_highlighting now govern a real code preview rendered under each console finding (#380)

Changed

• •fat-model, nesting-depth, method-length, helper-function-abuse and env-example-documented warn instead of failing a default fail_on: high build, and authentication-authorization reports an unprotected route as Critical, after every analyzer's severity metadata was audited against the findings it emits (#347)
• •php-side-filtering reports High rather than Critical, since Critical is reserved for security exposure, data loss, or an app that cannot serve requests (#349)
• •shield:analyze exits 1 when an analyzer could not complete; add the analyzer id to dont_report in config/shieldci.php to waive one (#351)
• •Requires guzzlehttp/guzzle ^7.0|^8.0 (was ^7.0), so installing on a Laravel 13 app no longer fails or downgrades the app's guzzle (#359)
• •A malformed config value is now a suppressible finding rather than an analysis error, and a missing prerequisite reports skipped, across cache-driver, queue-driver, session-driver, mysql-single-server-optimization, view-caching, config-caching, collection-call-optimization and phpstan (#362)
• •Requires shieldci/analyzers-core ^2.3 (was ^2.1) for the config-location helpers the unpublished-config fixes now resolve through (#373)

Fixed

• •logic-in-blade flags file_get_contents() as an API call only when the argument spells out a remote target, so {!! file_get_contents(public_path('img/logo.svg')) !!} is no longer reported (#341)
• •phpstan reports an error instead of a clean pass when a run does not finish, such as an internal error or a configured path that does not exist (#342)
• •collection-call-optimization works in an installed package at all: its shipped config included Larastan by a path resolving inside vendor/shieldci/laravel/vendor, so PHPStan aborted and the analyzer reported a pass on every real install (#345)
• •phpstan no longer reports the Larastan 2.9.0 env-call finding twice, once under Other PHPStan Issues and once through env-call-outside-config (#350)
• •phpstan no longer reads the unmatched ignore patterns in a project's own phpstan.neon as an analysis that did not complete (#354)
• •cache-driver assesses the driver when config/cache.php has not been published, instead of erroring out on a stock Laravel 11+ skeleton (#356)
• •Eight analyzers omit the issue location when the config file they report on is not published, rather than pointing into a file merged from the framework or fabricating line 1 (#361)
• •The exit-code gate now sees a failure that names no issue, waives dont_report analyzers under fail_threshold, and falls back to the documented default on an unrecognised fail_on (#363)
• •shield:baseline no longer waives an analyzer that could not run by writing it into the baseline's dont_report, and names the analyzers the baseline does not cover (#365)
• •A failed analyzer's exception class and stack trace survive into the JSON report, and timeToFix reaches --format=json (#366)
• •shieldci.report.format and SHIELDCI_REPORT_FORMAT take effect: --format declared a default of its own, so the config fallback behind it was unreachable (#370)
• •shield:analyze writes no ANSI escapes to a piped or redirected run, and honours --no-ansi, NO_COLOR and FORCE_COLOR throughout rather than for a handful of messages (#372)
• •shield:analyze --format=json keeps advisories such as a baseline notice or an unmapped APP_ENV on stderr, so the report on stdout stays parseable (#374)
• •--output writes to the path it validated, resolved against base_path(), and always as JSON rather than console art (#379)
• •An empty or missing shieldci.paths.analyze falls back to the shipped paths, instead of leaving 108 file analyzers scanning nothing and reporting a pass (#382)

Added

• •EloquentModelDetector: verdictForClassName()/isModelClassName() resolve a class reference through the referencing file's imports (#326)
• •eloquent-n-plus-one answers conclusively once a model's whole chain is read, so plain columns like sku are no longer flagged (#334)

Fixed

• •logic-in-blade exempts paginator window views, wherever they live, from the move-to-controller checks (#327)
• •logic-in-blade nested-@foreach now matches a linear search on the inner loop's key, not only its value (#329)
• •eloquent-n-plus-one treats snake_case property access as a column, so *_type columns are no longer flagged (#331)
• •eloquent-n-plus-one resolves relationships from traits and parents, so $user->notifications on Notifiable is no longer flagged (#333)
• •phpstan gives each error one category, ending duplicate findings and inflated counts; unmatched errors go to a new other category (#337)
• •service-container-resolution handles php-parser 5.9's ArgPlaceholder, restoring container-call detection (#338)

Fixed

• •xss-vulnerabilities no longer flags a single-line <script> tag's own HTML attributes (such as a CSP nonce) as JavaScript-context injection (#324)

Fixed

• •env-example-documented no longer flags bare env() keys read in vendor-named config files such as services.php (#322)

Fixed

• •env-example-documented now requires a .env.example entry only for config env() keys without a default (#320)

Added

• •env-example-documented now also reports an env() key read by the app's own config/ files but absent from .env.example, per key at the config file and line; keys shipped by installed packages' vendor configs and stock Laravel skeleton keys are exempt, and an ignored_keys option (wildcards allowed) covers the rest (#318)
• •env-variables-complete gains opt-in report_defaulted and report_redundant options (default off) that report config-defaulted absences and .env values restating a config default as Info issues (#317)

Fixed

• •env-variables-complete no longer flags a variable missing from .env when its env() call in config/ supplies a real default, so a lean .env holding only overrides and secrets passes; a bare env('KEY') or explicit null default still reports High (#317)

Fixed

• •public_routes now composes route-group prefixes into the full URI before matching the allowlist, so a prefixed nested route is no longer flagged as unprotected (#305)
• •authentication-authorization now resolves string middleware aliases (e.g. ['device.token']) to their class via an alias map from bootstrap/app.php and app/Http/Kernel.php, so a route guarded by a custom alias is no longer flagged as missing authentication; auth.basic is recognised too (#312)
• •vulnerable-dependencies now hydrates each OSV advisory (GET /v1/vulns/{id}) for its real title, CVE, and affected ranges, matches comma-separated ranges as AND, and fails open when a range can't be resolved (#313)
• •login-throttling no longer flags Sanctum-style APIs: it recognises $middleware->throttleApi() as global throttling, detects fluent/array throttled route groups via AST line ranges, and skips non-credential endpoints like auth/logout, auth/me, and auth/signout (#314)
• •service-container-resolution no longer flags container access inside addGlobalScope(), addGlobalScopes(), or resolveRelationUsing() closures, which Eloquent invokes in a DI-impossible context like the already-exempt model-event closures; service bindings stay flagged (#315)