--- title: LaraPlugins Security Advisories, Health Badges & Sync Fix description: LaraPlugins.io added security advisory checks for Laravel packages, and the launch exposed a two-month-old bug where a pipeline restructuring had silently... canonical: https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LaraPlugins Security Advisories, Health Badges & Sync Fix | daily.dev og:description: LaraPlugins.io added security advisory checks for Laravel packages, and the launch exposed a two-month-old bug where a pipeline restructuring had silently... og:url: https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi og:image: https://api.daily.dev/og/posts/BSiLm2iSI.png og:image:alt: LaraPlugins Security Advisories, Health Badges & Sync Fix og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LaraPlugins Security Advisories, Health Badges & Sync Fix **[Daniel Petrica](https://daily.dev/sources/danielpetrica)** · 3 min read · 0 upvotes · 0 comments ## Summary LaraPlugins.io added security advisory checks for Laravel packages, and the launch exposed a two-month-old bug where a pipeline restructuring had silently stopped syncing plugin versions while health scores kept updating normally. The fix re-enables daily and weekly version syncs, switches to cursor-based chunked iteration to cut memory usage during backlog processing, and adds a live Packagist API fallback so advisory checks stay accurate even if local data lags. The post also introduces README health badges showing a plugin's health score and security status, and mentions an MCP server for pulling advisories directly in an editor. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why were some Laravel packages showing incorrect security advisory or health scores on LaraPlugins.io? A pipeline restructuring disabled the old Packagist version sync commands and replaced them with a health-sync command that updated health scores but never synced plugin versions, creating a two-month stale version data backlog. This surfaced only when a new security advisory feature began cross-referencing version data, causing inaccurate advisory and health scores. _Anyone weighing package health signals can follow fixes like this Laravel advisory sync issue on daily.dev._ ### How can I show a Laravel package's health score and security status in my README? LaraPlugins.io provides embeddable SVG health badges for Packagist packages, generated with a URL like laraplugins.io/badges/plugin/vendor/package.svg, linking to the plugin's page. Replace vendor/package with the actual Packagist name, or use the get-embed button on the plugin's page to grab the markdown snippet automatically. _Maintainers adding trust signals to their README can track tools like this on daily.dev._ ### How do you keep security advisory data accurate for a package when the local version cache is stale? Add a fallback to the live Packagist API so that even if local version data is behind due to a sync failure, advisory checks pull the latest version info directly from Packagist. This decouples advisory accuracy from the health of the internal sync pipeline, so badges stay correct regardless of sync state. _Developers designing resilient data pipelines can follow patterns like this fallback fix on daily.dev._ ## Similar posts on daily.dev - [LaraPlugins Security Advisories, Health Badges & Sync Fix](https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-xdpagulgi) · Daniel Petrica · 12 upvotes · 2 comments - [LaraPlugins Perf Audit: 12 Fixes That Saved my server](https://daily.dev/posts/laraplugins-perf-audit-12-fixes-that-saved-my-server-hsyu1pijo) · Daniel Petrica · 4 upvotes · 0 comments - [Laravel Lang packages hijacked to deploy credential-stealing malware](https://daily.dev/posts/laravel-lang-packages-hijacked-to-deploy-credential-stealing-malware-tennbnuyq) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#laravel](https://daily.dev/tags/laravel) [View this post on daily.dev](https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LaraPlugins Security Advisories, Health Badges & Sync Fix","url":"https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi"},"datePublished":"2026-09-29T12:32:29.186Z","dateModified":"2026-09-29T12:32:58.576Z","description":"LaraPlugins.io added security advisory checks for Laravel packages, and the launch exposed a two-month-old bug where a pipeline restructuring had silently...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a7067de921dbe19f92dbd07655a1a06?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a7067de921dbe19f92dbd07655a1a06?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Daniel Petrica","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Daniel Petrica","logo":"https://media.daily.dev/image/upload/s--jkfwlnJz--/f_auto,q_auto/v1774964393/logos/danielpetrica?_a=BAMAMiWQ0","url":"https://daily.dev/sources/danielpetrica"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,laravel","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Daniel Petrica","item":"https://daily.dev/sources/danielpetrica"},{"@type":"ListItem","position":3,"name":"LaraPlugins Security Advisories, Health Badges & Sync Fix"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/laraplugins-security-advisories-health-badges-sync-fix-bsilm2isi#faq","mainEntity":[{"@type":"Question","name":"Why were some Laravel packages showing incorrect security advisory or health scores on LaraPlugins.io?","acceptedAnswer":{"@type":"Answer","text":"A pipeline restructuring disabled the old Packagist version sync commands and replaced them with a health-sync command that updated health scores but never synced plugin versions, creating a two-month stale version data backlog. This surfaced only when a new security advisory feature began cross-referencing version data, causing inaccurate advisory and health scores. Anyone weighing package health signals can follow fixes like this Laravel advisory sync issue on daily.dev."}},{"@type":"Question","name":"How can I show a Laravel package's health score and security status in my README?","acceptedAnswer":{"@type":"Answer","text":"LaraPlugins.io provides embeddable SVG health badges for Packagist packages, generated with a URL like laraplugins.io/badges/plugin/vendor/package.svg, linking to the plugin's page. Replace vendor/package with the actual Packagist name, or use the get-embed button on the plugin's page to grab the markdown snippet automatically. Maintainers adding trust signals to their README can track tools like this on daily.dev."}},{"@type":"Question","name":"How do you keep security advisory data accurate for a package when the local version cache is stale?","acceptedAnswer":{"@type":"Answer","text":"Add a fallback to the live Packagist API so that even if local version data is behind due to a sync failure, advisory checks pull the latest version info directly from Packagist. This decouples advisory accuracy from the health of the internal sync pipeline, so badges stay correct regardless of sync state. Developers designing resilient data pipelines can follow patterns like this fallback fix on daily.dev."}}]} ```