Code review for Laravel that knows what depends on your change.
A Laravel codebase is built on inheritance: models, repositories, jobs and framework classes you extend. Change a parent class and the code that breaks is often a subclass the pull request never touches, so neither the diff nor a reviewer reading only the diff ever shows it.
Veridu searches the repository for the code your change affects, puts it in front of two independent AI reviewers from different vendors, and drops any finding it cannot ground in the code. Here is a bug that shipped in Laravel itself, and what Veridu shows on that pull request.
laravel/framework#55142 ([12.x] Add CacheFlushed Event) made the cache repository fire two new events when it is cleared. Five files, with tests:
public function clear(): bool
{
$this->event(new CacheFlushing($this->getName()));
$result = $this->store->flush();
if ($result) {
$this->event(new CacheFlushed($this->getName()));
}
return $result;
}TaggedCache extends Repository and replaces event(). It assumes every event it receives has a setTags() method. The two new event classes do not.
protected function event($event)
{
parent::event($event->setTags($this->tags->getNames()));
}So clearing a tagged cache with events enabled throws. The change merged, shipped in v12.4.0, was reported in #55322, and was fixed in #55405 for v12.10.0.
The diff adds a $this->event() call. Before either reviewer saw the change, Veridu searched the repository for subclasses that replace event(), found exactly one, and gave both reviewers its code under Subclass overrides of methods this diff calls, with the question it raises: does each override still accept what the new call passes it?
Tagged cache flush events call missing setTags()
Calling clear() on a tagged cache will attempt to dispatch CacheFlushing/CacheFlushed through TaggedCache::event(), which calls setTags() on the event object, but the new event classes do not provide setTags().
New CacheFlushing/CacheFlushed events lack setTags(), will fatal on TaggedCache flush
TaggedCache overrides Repository::event() to call $event->setTags($this->tags->getNames()) on every event passed through it. Since Repository::clear() is inherited by TaggedCache, calling clear() on a tagged cache instance will invoke setTags() on an object that doesn't define it.
Both reviewers worked independently and both cite the TaggedCache override Veridu retrieved.
Not blocked. Veridu blocks only when both reviewers report the same defect at the same place. Here one anchored the bug at the new call and the other at the event class, so Veridu did not count them as one confirmed finding. It sent two high-severity findings to a human instead, which is where a one-line fix gets made before merge.
We added the subclass-override search after Veridu missed this bug. On 2026-10-13, before it existed, the same review returned no finding about setTags(): one reviewer reported nothing, the other two low-severity notes about tests and the description. With the evidence, both found the fatal.
One catch is an example, not a rate. Before shipping the search we ran it over 165 recent pull requests from nine PHP projects, including Laravel, Symfony, Filament and Statamic. It added evidence to three, each a genuine override of a method the change calls, and stayed silent on the rest.
A cache repository on the array store, with an event dispatcher, run at the pull request's head and at the fix.
Before the reviewers run, Veridu searches the repository and hands them:
- Subclass overrides. When the diff adds a $this->method() or static::method() call, the subclasses (two levels down) that replace that method.
- Callers of a changed signature. Code that calls a method whose parameters or visibility changed.
- Implementations of a changed contract. Classes implementing an interface or abstract method the diff changed, up to ten.
- References to removed code. Places that still call a method or class the diff removed or renamed.
It is a bounded text search, not a full call graph. It does not yet follow facades, container bindings or event listeners, and each search is capped so a large codebase cannot flood the review.
Does it work on private Laravel repos?
Yes. Install the GitHub App on the repos you choose and it reviews their pull requests; the Solo and Team plans cover private repos. You can also run the CLI locally with your own API keys.
What does it cost?
20 reviews a month on public GitHub repos are free, no card. Solo and Team plans add private repos and a monthly allowance, with top-ups.
What about Blade, Livewire and Inertia front ends?
The tracing on this page runs on pull requests that change only PHP. A pull request that also touches Blade, JavaScript or Vue files is reviewed by agent reviewers that search the checkout themselves, without this evidence step, so the PHP side is reviewed that way too.
Will it block my merges?
Only when both reviewers independently report the same defect and both rate it at or above your blocking threshold. Everything else is surfaced for a human, as in the example above.
How is this different from PHPStan or Larastan?
Use them. Static analysis proves type facts about code; it does not judge whether a change does what it should. Veridu reads the change with its dependents in front of it and reports defects a type checker has no rule for, like an override whose assumptions a new call breaks.
Public repos need only the PR URL and a free account. Private repos: connect them through the GitHub App, or run the CLI locally.
npm install -g veridu · veridu review <pr-url>