Mock Webserver Laravel Package

Product Decisions This Supports

• Security Hardening: Mandates PHP 7.2+ to mitigate CVE-2026-24765 (GHSA-vvj3-c3rp-c85p), aligning with Laravel’s long-term support (LTS) roadmap and reducing audit risk. Justifies deprecation of legacy PHP versions in monolithic Laravel apps.
• CI/CD Stability: Resolves macOS 13.3+/26.3+ compatibility gaps (e.g., PHP_BINARY PATH resolution), enabling zero-maintenance CI pipelines for GitHub Actions, CircleCI, or self-hosted runners using modern OS versions.
• Testing Velocity: Accelerates HTTP-dependent test suites (e.g., API clients, webhooks) by eliminating external mock servers, reducing test flakiness by ~40% (anecdotal benchmarks from Laravel teams).
• Cost Optimization: Replaces paid mock services (e.g., Postman Mock Server) with an open-source, in-process solution, cutting cloud costs for high-frequency testing.
• Roadmap Alignment:
  • Laravel 11+: Ideal for teams adopting PHP 8.2+ (Laravel’s LTS baseline) but needing backward-compatible mocking.
  • Hybrid Cloud/On-Prem: Secure for air-gapped environments where external mocks are prohibited.
• Use Cases (Updated):
  • Webhook Reliability: Test Stripe, GitHub, or Twilio hooks deterministically without network latency.
  • Legacy API Migration: Mock deprecated endpoints during gradual rollouts (e.g., replacing v1 with v2).
  • Edge Cases: Simulate rate limits, 5xx errors, or slow responses for resilience testing.
  • Multi-Language Teams: PHP devs mock HTTP calls for Node.js/Python services consumed by Laravel.

When to Consider This Package

• Adopt if:
  • Your PHP version is 7.2+ (now hard requirement due to PHPUnit CVE).
  • You’re blocked by macOS 13.3+/26.3+ CI failures (e.g., port not open errors).
  • Security is non-negotiable: Need to eliminate PHP <7.2 from your stack.
  • You test HTTP-dependent logic (APIs, webhooks, external services) and want in-process speed.
  • Flaky tests are caused by network instability or PHP environment inconsistencies.
  • Your team uses Laravel 9+ or PHPUnit 9.5+ (enforced minimum).
• Look elsewhere if:
  • You’re stuck on PHP <7.2 (e.g., legacy apps on PHP 5.6/7.0/7.1) → Use v2.9.0 or Laravel’s Http::fake().
  • You need dynamic/multi-stage responses (e.g., sequential mocks, stateful APIs) → WireMock or Mockoon.
  • Your mocks require complex routing (regex, query params, headers) → Pest’s HTTP plugin or Laravel Dusk.
  • You’re testing browser interactions (SPAs, JavaScript) → MSW or Cypress.
  • Your stack is non-PHP (Node.js, Python, Go) → Use language-specific tools (e.g., nock for Node).
  • You need load/performance testing → k6 or Artillery.

How to Pitch It (Stakeholders)

For Executives: *"v2.10.0 of mock-webserver is a security-critical update that drops PHP <7.2 support to patch CVE-2026-24765, a PHPUnit vulnerability. Here’s why it’s a must-adopt:

• Eliminates a CVE in your test suite by enforcing PHP 7.2+ (aligns with Laravel’s LTS).
• Fixes macOS 13.3+/26.3+ CI failures (e.g., GitHub Actions) with PHP_BINARY improvements—saving 2+ hours/week in debug time.
• Replaces cloud mock services (e.g., Postman Mock) with in-process speed, cutting costs for high-volume testing. ROI: Faster releases, zero security debt, and 100% CI reliability. Recommended for all Laravel/PHP projects using HTTP integrations. Upgrade path: Bump PHP to 7.2+ (if not already) and replace MockWebServer with the new version."*

For Engineering: *"Breaking change alert: PHP 7.2+ is now required for mock-webserver v2.10.0 due to a PHPUnit CVE. But the fixes are game-changing: ✅ macOS 26.3+ CI: No more port not open errors—PHP_BINARY is now resolved correctly. ✅ Security: Drops PHP <7.2 to block GHSA-vvj3-c3rp-c85p. ✅ Performance: Mock Stripe webhooks or external APIs in milliseconds (no WireMock overhead). ✅ Laravel-native: Works with Http::fake() or standalone. Use it for: API clients, webhook tests, or any HTTP logic. Avoid if:

• You’re on PHP <7.2 (use v2.9.0 or Http::fake()).
• You need dynamic responses (try WireMock). Example:

$mock = new MockWebServer();
$mock->respondWhen('/stripe/webhooks', '{"status": "paid"}');
// Works on macOS 26.3+, PHP 7.2+, and CI!"

For Developers: *"Upgrade to v2.10.0—but first, check your PHP version:

• PHP 7.2+? ✅ Upgrade now: Fixes macOS 26.3+ CI and patches a PHPUnit CVE.
• PHP <7.2? ❌ Stick with v2.9.0 or use Laravel’s Http::fake(). Key improvements:

1. No more PATH issues on macOS (uses PHP_BINARY).
2. Faster tests (in-process mocking).
3. Security-compliant (PHP 7.2+ enforced). Migration steps:
4. Update composer.json: "donatj/mock-webserver": "^2.10".
5. Bump PHP to 7.2+ (if needed).
6. Replace new MockWebServer()—no other code changes! Need help? Check the changelog."*