Laravel Sens Alimtalk Laravel Package

Getting Started

v8 is a maintenance-heavy major: the public API is essentially unchanged, but the platform floor moved to PHP 8.1 and Guzzle ^7.15.2. Start by confirming your runtime before you read any docs:

php -v                      # must be >= 8.1
composer why guzzlehttp/guzzle

If you are on PHP 7.x or are pinned to Guzzle 6 (directly, or transitively via an old SDK such as a cloud storage or HTTP client adapter), stop and plan that upgrade first — composer update will refuse to resolve otherwise.

Once installed, the first-run path is the same as previous majors:

1. Publish the config (php artisan vendor:publish --provider="...ServiceProvider") and fill in credentials — the package signs every outbound request for you, so the credential pair in the config is the only auth surface you touch.
2. Create a notification and return the package's message object from the channel method (toXxx($notifiable)).
3. Send it to a test notifiable with Notification::route(...) or $user->notify(...) and inspect the payload in the logs before wiring it to a real recipient.

The first use case worth proving out is a dual-target send: build one message, call linkMobile() for the app/deep-link destination and linkPc() for the desktop/web destination, and confirm both render correctly. That single test exercises payload building, request signing, and the channel in one go — which is exactly what the new 17-test suite covers, so if your payload looks wrong it is far more likely your message construction than the transport.

Implementation Patterns

Build messages, don't hand-roll payloads. The value of the package is that the message object owns payload construction and the transport owns signing. Keep that separation: assemble the message in your notification class, and never call the HTTP client directly "just this once" — you will lose signing and the retry/error semantics.

Treat linkMobile() / linkPc() as a pair or not at all. A common production pattern is a notification class that branches on the recipient's platform:

public function toPackage($notifiable)
{
    $message = (new Message)->title($this->title)->body($this->body);

    return $notifiable->prefers_desktop
        ? $message->linkPc($this->desktopUrl)
        : $message->linkMobile($this->deepLink);
}

v8 fixed these methods to stop creating dynamic properties. Behaviour is the same on PHP 8.1–8.5, but if you were reading or unsetting the resulting ad-hoc properties anywhere (reflection, get_object_vars(), a serialized payload snapshot in a test), that will now be null or absent. Audit before upgrading; this is the one BC-adjacent change with no deprecation notice.

Queue the channel. Notification channels do network I/O. Implement ShouldQueue on the notification (or use Notification::route(...)->notify() inside a job) so a slow or failing endpoint does not block a request, and so Laravel's retry/backoff applies. Combine with ->locale() if your templates are localised.

Test the payload, not the wire. Because the package now actually ships tests for payload building and signing, mirror that in your own suite: assert on the message object and the built payload array, and fake/stub the HTTP layer for anything end-to-end. This keeps you fast and keeps your tests valid across patch releases.

Pin the major, float the patch. For a package whose transport depends on Guzzle's TLS/CVE posture, "^8.0" plus a committed lockfile is the right contract. Let Renovate/Dependabot propose patch bumps rather than pulling transport fixes implicitly.

Gotchas and Tips

• Guzzle 6 is a hard blocker, not a warning. ^7.15.2 is required because Guzzle 6 has no release fixing CVE-2026-69245 / CVE-2026-69246. If composer update fails to resolve, run composer why-not guzzlehttp/guzzle ^7.15.2 — the culprit is usually a stale package holding Guzzle 6 down, and upgrading that package is the actual work item.
• Check for dynamic-property warnings in logs. On PHP 8.2+ an old copy of this package would emit Creation of dynamic property ... is deprecated whenever a link was set. If you still see those after upgrading, you have a second copy of the package installed, or a subclass that copies the old pattern.
• Coverage is real now, but thin. 17 tests over payload building, signing, and the channel is a large step up from zero executable tests — enough to catch regressions in the main path, not enough to assume edge cases (empty link, oversized payload, non-ASCII titles, retry/failure paths) are covered. Keep your own assertions on the payload you care about.
• Laravel 13 support is additive. Supporting 13 does not mean dropping 10/11/12; but do verify your Laravel version against the package's composer.json constraints rather than the release title, since transitive requirements (PHP 8.1, Guzzle 7) can effectively narrow the usable matrix.
• Contributor note: PHPUnit schema changed. The repo migrated phpunit.xml.dist to the PHPUnit 10+ schema, so if you are running the package's suite locally against PHPUnit 9 you will get schema warnings or failures. Match the toolchain (PHPUnit 10–13) before opening a PR, and drop --verbose from any scripts you copied out of CI — it was removed.
• CI runs PHP 8.1–8.5. If you develop on 8.4/8.5 but deploy on 8.1, trust CI's lowest-version job over your local green build; implicit-nullable and deprecation behaviour differ meaningfully across that range.
• Extension point: signing and payload construction are the two seams worth knowing. If you need a custom header, a proxy, or a mock transport, inject it at the Guzzle client/config layer rather than overriding the message class — that is the boundary the package's own tests exercise, so it is the one least likely to break under you.