- How do I install env-sync-laravel in a Laravel app?
- Install it with Composer using dragon-code/env-sync-laravel, then rely on Laravel package auto-discovery. Publish the config only if you need to adjust adapter settings. The assessment describes the install path as trivial and frictionless on Laravel 11, which also means it can be approved by default too easily. Review secret-handling and repository status before adding it to a real project.
- Does env-sync-laravel support Laravel 11?
- Yes. Version 2.5.0 added Laravel 11 support in a compatibility patch with no breaking changes. It does not announce Laravel 12 or PHP 8.4 support. Because the repository status is uncertain, verify the current release before relying on it for a long-lived app.
- What does env-sync-laravel actually do?
- It is a Laravel adapter for the upstream dragon-code/env-sync package. It compares .env with .env.example, detects missing environment variables, and updates files to reduce configuration drift and onboarding issues. Architecturally, it is a thin adapter rather than a full Laravel-native configuration system.
- Is env-sync-laravel safe for production?
- The TPM assessment rates secret handling as critical and technical risk as high. It says the package moves .env, the highest-sensitivity artifact, to a remote backend outside Laravel's configuration pipeline and outside a secrets manager. No encryption, transport, retention, or access-control work appeared in 2.5.0. Do not approve it for production-critical use without a security review.
- How does env-sync-laravel handle secrets in .env files?
- The assessment says this remains unanswered: which storage backends upstream supports, whether secrets are encrypted client-side, and who holds the key. Version 2.5.0 adds no encryption or access-control work. It is a thin adapter over dragon-code/env-sync, so you must evaluate the upstream package too. Check whether your security policy permits .env contents to leave the developer machine at all.
- Is env-sync-laravel actively maintained?
- The repository was previously recorded as archived, and 2.5.0 is a single-line release from one contributor in one PR. It is unclear whether the repo was unarchived with a resumed single maintainer or archived with 2.5.0 as the terminal release. Star count and dependent count remain negligible, so there is no strong production adoption signal. Re-verify the archived status before treating it as maintained.
- What are alternatives to env-sync-laravel for .env.example syncing?
- If you only need missing-key detection, a small Artisan command or a CI diff against .env.example avoids moving .env data to a remote backend. If you need synchronization, prefer a workflow that keeps secrets in your existing secrets manager. The assessment does not identify a specific drop-in replacement, so evaluate alternatives against the same secret-handling and maintenance criteria.
- Can I use env-sync-laravel in CI/CD deployment pipelines?
- The package is described as helping across development, staging, and deployment, but the assessment flags supply-chain drift: a minor bump on a repo of uncertain status means composer update can move consumers from 2.4 to 2.5 with no review gate. Pin the exact version and review updates before CI runs them. Also confirm that your deployment policy allows .env contents to be sent to the upstream backend.
- Does env-sync-laravel support Laravel 12 and PHP 8.4?
- No. The 2.5.0 release explicitly adds Laravel 11 support, and the assessment says Laravel 12 and PHP 8.4 are unsupported and unannounced. That leaves the compatibility ceiling one version away rather than two. Treat Laravel 11 as the current ceiling unless a newer release appears.
- How should I test env-sync-laravel before adopting it?
- Start in a non-production environment with a disposable .env and pin the exact Composer version. Check whether the repository is archived, inspect whether 2.5.0 pins or widens the upstream dragon-code/env-sync constraint, and confirm the storage backend and encryption model. Run it through your CI matrix and get security sign-off before any production use.