- Is fourxxi/vault-bundle compatible with Laravel?
- No. fourxxi/vault-bundle is a Symfony bundle built around Symfony's Bundle registration, DI container, and compiler passes. Laravel has no bundle concept; it uses service providers and a container with different binding semantics. Making it work would mean vendoring and stripping the Symfony scaffolding, at which point the retained value is a thin HTTP wrapper around Vault's REST API.
- How do I install fourxxi/vault-bundle?
- It is installed as a Symfony bundle via Composer, then registered in the Symfony application and configured with Vault connection settings. There is no supported Laravel installation path, and the package's 2018-era Composer constraints will likely conflict with a modern Laravel and PHP 8.1+ stack. Expect to fork and relax composer.json before any Laravel experiment.
- Does fourxxi/vault-bundle support Laravel 10 or 11?
- No. The package was last released in January 2018 and targets Symfony 2.x and 3.x with PHP 5.6 and 7.0-era constraints. Those constraints will not resolve against Laravel 10 or 11. A fork-and-relax composer.json exercise would be the minimum before attempting integration.
- How does fourxxi/vault-bundle retrieve secrets from Vault?
- It exposes secret retrieval through Symfony services wired by the bundle's dependency injection integration. Connection settings are configurable, and the bundle supports environment-aware Vault path support for different application environments. In Laravel you cannot use that Symfony service wiring directly, so the API is not framework-friendly for Laravel without a rewrite.
- Is fourxxi/vault-bundle safe to use in production?
- The technical assessment verdict is do not adopt it as a production dependency. It is stale, with 12 stars, 0 dependents, and no release since January 2018, and it sits in the security-sensitive secret retrieval path. There is no maintainer to escalate CVEs or hardening patches to, and no public evidence it has been audited or run against a real Vault cluster. You would be the first meaningful test case.
- What are better alternatives to fourxxi/vault-bundle for Laravel?
- The lowest-risk option is to remove the app-level Vault dependency entirely and use Vault Agent or the Vault Secrets Operator to inject secrets as environment variables or files at deploy time; Laravel reads env() and files as usual. If runtime fetch is genuinely required, define an internal SecretProvider contract and implement a Vault adapter using Guzzle directly or a maintained community PHP Vault SDK. That is roughly 200 to 400 lines fully under your control.
- Can fourxxi/vault-bundle work with Vault KV v2 or AppRole authentication?
- It is a poor fit. The bundle predates general KV v2 adoption, namespaces, and current AppRole and token-renewal patterns. The endpoints it calls may still work, but they will not match the auth and secret-engine topology a modern Vault deployment uses. Expect silent correctness failures rather than clean errors.
- How do I migrate a Laravel app away from fourxxi/vault-bundle?
- Treat the bundle as a reference implementation only: read its Vault API calls and implement a small internal adapter. If a migration is mandated, fork it to an internal namespace, relax Composer constraints, replace Symfony bundle wiring with a Laravel service provider, and pin an exact commit. Prefer eliminating the library need through Vault Agent or Vault Secrets Operator injection where possible.
- Does fourxxi/vault-bundle handle token renewal and lease TTLs correctly?
- That is a key risk. Vault returns lease durations and renewable tokens, and a 2018 client may not honour TTLs correctly against modern Vault, producing intermittent auth failures under load rather than clean errors. With zero dependents, there is no public evidence of anyone running it against a real Vault cluster.
- How should I test a Vault integration for Laravel if I cannot use fourxxi/vault-bundle?
- Do not rely on the bundle's ecosystem validation, because there is none. Test a first-party SecretProvider adapter against a disposable Vault dev server configured with KV v2 and AppRole, covering token expiry, renewal, and failure paths. If you must experiment with a fork, add contract tests around secret retrieval and auth lifecycle before trusting it anywhere near production.