- What is beeyev/thumbor-php used for?
- It is a thin PHP client that generates Thumbor URLs, including signed and unsigned variants, with support for resizing, cropping, filters, and security keys. It does not process images itself; it produces the URL your app or CDN hands to a Thumbor server. That keeps it at the edge of your image-delivery path with very little coupling.
- How do I install beeyev/thumbor-php in a Laravel app?
- Install it with Composer, for example composer require beeyev/thumbor-php, which pulls in version 2.1.0 or later on PHP 8.0+. The package is framework-agnostic and adds no runtime dependencies beyond PHP, so it drops into Laravel cleanly. You can instantiate the client directly or bind it as a singleton in your own service provider.
- Which PHP and Laravel versions does beeyev/thumbor-php support?
- Version 2.1.0 requires PHP 8.0 or higher and raises that floor from earlier releases. Any Laravel 9 or newer application already satisfies it, since Laravel 9 requires PHP 8.0, Laravel 10 requires 8.1, and Laravel 11 and 12 require 8.2. Note that PHP 8.1 is missing from the announced CI matrix, so treat 8.1 as untested rather than verified, and expect legacy Laravel 8 estates on PHP 7.4 to stay pinned to 2.0.3.
- Is upgrading to beeyev/thumbor-php 2.1.0 a breaking change?
- For most applications it is a no-op upgrade, but the dropped PHP 7.x support is breaking for anyone still on 7.4. The bigger hidden risk is the added PHP 8 type declarations: if you subclassed the client and override public or protected methods without matching return types, you will hit incompatible signature errors. Audit subclasses first, then diff generated image URLs against a 2.0.3 baseline, because URL changes silently bust CDN caches and invalidate Thumbor signatures.
- How do I generate a signed Thumbor URL with a security key?
- Pass your Thumbor security key when configuring the client, and the library computes the HMAC signature for each URL it builds. Keep the key in environment variables or config, never hardcoded in source. Cover signature generation with automated tests, since a wrong or rotated key surfaces as 403 responses at the Thumbor or CDN edge rather than in your application logs.
- Can I use beeyev/thumbor-php without Laravel?
- Yes. It is a plain Composer package with no framework coupling, so any PHP 8.0+ project can build Thumbor URLs with it. In Laravel you can wire it through your own container binding if you want it injected, but nothing in the package requires that.
- How do I resize, crop, and apply filters with beeyev/thumbor-php?
- The client exposes a fluent API where you set dimensions, fit-in behavior, crop mode, and filters by chaining calls before generating the URL string. That stateless builder design means each URL is composed independently, which is easy to reason about and easy to unit test. When you upgrade, compare the exact generated strings against a captured baseline to catch subtle ordering or encoding changes.
- How should I test Thumbor URL generation in my Laravel test suite?
- Assert the exact generated URL strings, including signatures, using normal PHPUnit assertions or snapshot tests. No HTTP calls are needed because the client is a pure URL builder, which makes tests fast and deterministic. After upgrading to 2.1.0, replay a captured set of 2.0.3 URLs and diff the output, and add a case that exercises the signing key configuration.
- What are alternatives to beeyev/thumbor-php?
- If you already run a Thumbor server, this package is a focused URL builder, while alternatives like intervention/image and league/glide handle local processing or Glide-style URLs instead. Spatie image-optimizer packages target optimization rather than Thumbor URL signing. Calling the Thumbor HTTP API manually is also possible, but you would be reimplementing signature and filter encoding yourself.
- Is beeyev/thumbor-php actively maintained and safe for production?
- It is a small-surface library with a single primary maintainer, and release 2.1.0 is a maintenance and modernization update adding PHPStan, Rector, PHP CS Fixer, and PHPUnit tooling that stays in require-dev with no production footprint. No CVE or security advisory is tied to this release, so there is no forced-upgrade trigger. The limited bus factor is acceptable for a URL builder, but pin ^2.1 and keep URL-output tests in your suite so an upstream change cannot pass unnoticed.