- Is cerbero/auth still maintained for current Laravel versions?
- There is no evidence of active maintenance: the package has roughly 48 stars, zero dependents, and no ecosystem signals that it tracks recent Laravel releases. Treat it as effectively dormant until you confirm the last commit date and release cadence on the repository and Packagist. If you adopt it, plan to fork it into a private VCS and pin a specific commit rather than relying on upstream fixes.
- Which Laravel and PHP versions does cerbero/auth support?
- The supported matrix must be read from its composer.json constraints; do not assume it covers your installed Laravel or PHP version. Laravel's authentication surface has changed repeatedly through guard contract updates, hashing defaults, and session and CSRF middleware changes, and a package this old is unlikely to have tracked them. Verify that Composer resolves it against your lockfile without --ignore-platform-reqs workarounds before writing any code.
- How do I install cerbero/auth with Composer?
- The typical path is composer require cerbero/auth, then registering or discovering the service provider, publishing its config, and running its migrations. Because the package has no dependents, there is little real-world evidence that a clean install works on modern Laravel, so budget for a vendor fork and patch instead. Validate the dependency graph first to ensure it does not pull in abandoned transitive packages that conflict with your lockfile.
- Will cerbero/auth collide with my existing users table or migrations?
- Possibly. It ships its own Eloquent-backed user model and likely its own users, role, and permission migrations, which can duplicate or conflict with tables your application already owns. Check for schema collisions and for published config or middleware alias registrations that clash with your app config before running any migration. Running the install on a disposable branch against a database copy is the safest way to surface conflicts.
- Is cerbero/auth safe to use in production authentication?
- Authentication is the highest-blast-radius area of any application, and an unmaintained package is a standing liability: no upstream fixes for CVEs, potentially outdated password hashing parameters, and unpatched password reset token handling. Run composer audit and check FriendsOfPHP advisories, and inspect how it handles sessions, rate limiting, and reset tokens. Unless you are prepared to own the fork and its security patching, prefer a maintained first-party solution.
- Does cerbero/auth use Laravel's native guards and password broker?
- This is the key architectural question and it must be verified in the source, not assumed. Confirm that it implements Illuminate\Contracts\Auth\Guard and UserProvider and delegates to the Hash and Password facades, rather than rolling its own implementations that bypass framework middleware. If it reimplements these, you inherit lock-in to a non-standard auth flow that complicates future upgrades and onboarding.
- Does cerbero/auth have tests, CI, or known security advisories?
- Test coverage and CI status are not documented in the package overview, so check the repository for a test suite and a CI badge. Run composer audit against your lockfile and search the FriendsOfPHP advisory database for the package and its dependencies. With 48 stars and zero dependents there is no community validation to fall back on, so treat the absence of evidence as a risk signal rather than a clean bill of health.
- What are the best alternatives to cerbero/auth?
- Laravel Breeze, Fortify, and Jetstream are the first-party options and cover login, registration, password reset, and in Fortify's case two-factor authentication with supported maintenance. A small in-house guard built directly on Laravel's auth contracts is also viable if you need something minimal. The package does not appear to offer anything these do not, so the choice is really about legacy compatibility, not capability.
- How do I migrate off cerbero/auth to Laravel's built-in authentication?
- Map the users table and any role or permission tables it created, then confirm password hashes are standard bcrypt or argon2 so they carry over without forcing resets. Re-point your guard configuration to a first-party user provider and remove the package's service provider, middleware aliases, and config. Sequence the cutover behind a feature flag so you can roll back, and keep a thin adapter over Laravel's auth contracts during the transition.
- Should I use cerbero/auth in a new Laravel project?
- No. For greenfield or actively upgraded applications, Laravel's first-party auth tooling covers the same ground with supported maintenance and no lock-in. The package is only plausible for a legacy application pinned to its supported version band, and even then it should be forked, pinned, and wrapped behind Laravel's auth contracts to preserve an exit ramp. Treat its fit as conditional on verified version alignment, not assumed.