Laravel Xhprof Laravel Package

Product Decisions This Supports

• Build vs. buy on internal performance tooling. Profiling a Laravel app in production or staging usually starts as a homegrown middleware + log-parsing project. This package replaces that with a maintained integration (service provider, request middleware, run storage, and a viewer for captured profiles), so the decision becomes "adopt a dependency" instead of "staff a small internal tool."
• Roadmap: framework upgrade planning. The 2.1.0 release adds Laravel 13 support. If your Laravel 12 → 13 upgrade is on the roadmap, this dependency is no longer a blocker — but only for the parts of your stack that do not rely on the XHProf PHP extension being rebuilt for the target PHP version. Treat extension availability as the real gate, not the package version.
• Incident and latency triage workflow. Function-level, hierarchical profiles answer "which call path is slow" in a way that APM traces often do not for PHP internals. That supports decisions about whether to invest in APM seat licensing versus a self-hosted profiler for a small team.
• Scoping performance work. Sampling controls and per-request enablement let you turn profiling on for a slice of traffic or a specific environment, which determines whether this is a "safe in production" tool or a "staging-only" tool for your org.
• Not supported by this release: no new user-facing features, no API changes, no deprecations. 2.1.0 is a compatibility and maintenance release (framework support plus CI/dependency bumps), so it does not open new product use cases on its own.

When to Consider This Package

Consider it when:

• You are on Laravel and need PHP-level, function-granular profiling — not just query logs or request timings — to diagnose CPU-bound or deeply nested call paths.
• You can install the underlying XHProf (or Tideways XHProf) PHP extension on the target environment. This is the hard prerequisite; without it the package has nothing to record. Confirm extension support for your PHP version before committing.
• You want profiles persisted and browsable after the fact (stored runs plus a UI), rather than an ephemeral CLI profiler output you paste into a file.
• You are planning or currently executing a Laravel 13 upgrade; 2.1.0 explicitly covers that.
• Your team is small enough that a self-hosted, low-ceremony profiler beats onboarding a full APM vendor.

Look elsewhere when:

• You need distributed tracing, cross-service spans, or always-on production observability — that is APM territory (Datadog, New Relic, OpenTelemetry-based stacks), not a single-process PHP profiler.
• You cannot install PHP extensions in your hosting environment (managed/PaaS runtimes with locked extension sets), or your platform is moving to a runtime where XHProf is unavailable.
• You need long-term retention, alerting, or SLO reporting; this is a diagnostic tool, not a monitoring system.
• Profiling overhead on hot paths is unacceptable and you cannot restrict it to sampled traffic or non-production environments.
• You want a vendor with an SLA and support contract. This is a community package with a single-maintainer risk profile — verify maintainer activity and issue responsiveness yourself rather than assuming it from a version bump.

How to Pitch It (Stakeholders)

For executives: This is a small, free, open-source add-on that lets our engineers see exactly which lines of code are slow, instead of guessing. The new 2.1.0 release keeps it compatible with the next Laravel version, which removes a known obstacle from our upgrade path at effectively zero cost. It is a diagnostic tool for engineers, not a monitoring platform — it does not replace our APM/alerting spend, and it carries single-maintainer risk, so we should treat it as an internal engineering utility rather than production-critical infrastructure.

For engineering: 2.1.0 is a minor, non-breaking release — Laravel 13 support plus routine CI/dependency bumps. No API changes, no deprecations, no migration work. Adopt it as a dev/staging profiling tool: install the XHProf extension, wire the middleware, keep sampling conservative, and validate the stored-run viewer against your DB before relying on it. Because the package tracks Laravel releases promptly, pin the version and let routine dependency updates flow through your normal review; do not assume the release note implies broader maintenance commitments. If you need cross-service tracing or always-on production instrumentation, propose an APM/OpenTelemetry path instead — this package does not cover that.