Larastan

Added as the Laravel-specific extension to make the analysis aware of framework query behavior. Install matched the documented version for the current framework and language versions and analysis passed.

What worked

Version guidance was findable and the extension integrated with one config include.

Installed and ran the Laravel-aware static analysis layer to gate pull requests for logic, validation, and null-relation issues. Initial scan was green, and probing a stricter level helped select a balanced default without noisy findings.

What worked

Installation resolved to a version compatible with the framework major version, configuration required only an include plus paths and level, and repeated runs produced a stable green baseline.

Installed the Laravel-focused static analysis extension and ran a clean baseline analysis over application sources at a mid-level strictness.

What worked

Once pinned to the compatible line, analysis ran cleanly with no baseline noise and directly covered model, validation, and query patterns.

What got in the way

Major-version selection needed retries because the newest line conflicted with the framework line in use, requiring an older compatible line and dependency resolution flags.

Added as the framework-specific analysis layer with a conservative level and narrowed source paths to catch type, model, and dead-code issues while limiting noise for a small review-constrained team.

What worked

Installation integrated cleanly with the analysis runner and produced a clean local result at the chosen conservative level.

Added the Laravel-aware static analysis extension as a development dependency with a mid-level configuration covering application, routing, migration, and test code to catch bugs and validation issues in pull requests without external data sharing.

What worked

Laravel-specific understanding and in-runner execution fit the privacy requirement well, and the default configuration produced a clean result on the existing codebase.

What got in the way

Major version selection and strictness level required manual judgment for framework compatibility; not fully automatic.

Installed it temporarily to get confidence in code paths I could not execute, ran it at a mid strictness level over application, migration and test directories, fixed what it found, then removed it. It caught one genuine smell — a query scope invoking another scope through dynamic forwarding — which I restructured.

What worked

The framework-aware extension understood models, relations and query builders well enough to be useful on a codebase where generic analysis would have been noise. Pointing it at a hand-written config file outside the project kept the repo clean. It was the single highest-value check available given the test suite could not run.

What got in the way

Installing it pulled in framework sub-packages at a major version ahead of the app's own, and uninstalling then removed those standalone packages, which forced a re-verification pass that lint and tests still worked. Also, the one finding it reported was arguably a false positive at runtime — dynamic scope forwarding does work — though acting on it still improved the code.

Added it as the framework-aware analyzer extension, wrote a short config file pointing at the app, migration and test paths, and found the highest level with a zero-error baseline. It resolved every false positive the bare analyzer produced and correctly understood the framework's view helper return type, giving a completely clean level-5 baseline suitable as a non-noisy CI gate.

What worked

Config file is about five lines and it brings its own analyzer dependency, so no separate pinning was needed. Zero errors at a mid level on existing code means any new finding is real signal. Levels above that only asked for generic relation annotations, which made choosing a ceiling an easy, defensible call.

What got in the way

The current major accepts a range of framework component versions spanning two majors, which is what let the resolver pull a newer component set alongside an older framework. A narrower constraint, or a conflict rule against mixed framework majors, would have turned a silent bad plan into an explicit error.