Keycloak Sso Laravel Package

Product Decisions This Supports

• Security and compliance roadmap: v4.0.0 is primarily a security and platform-support release. It raises minimum dependency versions and adds Composer conflict rules to block known-vulnerable releases, with composer audit reported clean at both lowest and highest resolvable dependencies. This supports decisions to keep SSO authentication dependencies within an auditable security posture.
• Build vs. buy for SSO: The package remains a candidate for buying/leveraging SSO integration rather than building and maintaining authentication plumbing in-house, especially where the team wants Laravel-native integration and active dependency maintenance.
• Platform modernization: The supported matrix is PHP 8.2–8.5 and Laravel 10–13. This helps decide whether to standardize SSO work on currently supported PHP/Laravel versions.
• Upgrade sequencing: Dropping PHP <8.2 and Laravel 8/9 is a lifecycle decision point. Teams on older platforms should either stay on v3.x or schedule a platform upgrade before adopting v4.
• Low application migration cost, dependency risk to manage: The release states no application code changes are required. The main PM concern is Composer dependency resolution and ensuring other packages are compatible with the raised minimums.
• Feature and use-case fit: Use this package where the product needs SSO integration in a Laravel application and the team values maintained security constraints over bespoke implementation.

When to Consider This Package

Consider this package when:

• The application is on Laravel 10–13 and PHP 8.2–8.5, or the team can upgrade to that range.
• You need SSO integration in a Laravel application and prefer an existing package over building and maintaining the integration internally.
• Security review requires current dependency constraints and a clean composer audit.
• You are already on v3.x and can move to a supported PHP/Laravel baseline; v4 should be a Composer-level upgrade with no application code changes.
• You want a package with explicit support for a broad but current Laravel/PHP matrix.

Look elsewhere or defer adoption when:

• The application is on PHP <8.2 or Laravel 8/9 and cannot upgrade. Stay on tekinfopg/sso-helper-laravel:^3.0 rather than forcing v4.
• The application has strict dependency constraints that conflict with the raised minimum versions, even if the package’s conflict rules only block vulnerable releases.
• The required SSO protocols, identity providers, or customization needs are not covered by the package; validate fit before committing.
• The team is not using Laravel/PHP or needs a framework-agnostic SSO solution.

How to Pitch It (Stakeholders)

For executives: v4.0.0 strengthens the security posture of our Laravel SSO helper by enforcing patched dependency versions and blocking known-vulnerable releases. It keeps the package aligned with supported PHP and Laravel versions, reduces the risk of shipping vulnerable authentication dependencies, and avoids custom SSO maintenance. The trade-off is that older PHP/Laravel stacks must stay on v3.x or plan an upgrade.

For engineering: Upgrade via composer require tekinfopg/sso-helper-laravel:^4.0. No application code changes are expected. v4 requires PHP 8.2–8.5 and Laravel 10–13, raises guzzlehttp/guzzle to ^7.15.2, and adds conflict rules against vulnerable versions of related dependencies. Validate Composer resolution, run composer audit, and regression-test SSO flows. If the app is still on PHP <8.2 or Laravel 8/9, remain on v3.x until the platform upgrade is complete.