- How do I install iserranodev/encrypt-bundle in a Laravel application?
- Install it with Composer by running composer require iserranodev/encrypt-bundle from your project root. Because the 1.3.1 release updated its dependency constraints for Symfony 7, run composer update --dry-run first on older applications to confirm nothing conflicts. After installing, point the package config at your encryption key, ideally through an environment variable, before you encrypt any real data.
- Does encrypt-bundle support Laravel 11 and Laravel 12?
- The practical baseline is Laravel 11 or 12, since those releases ship Symfony 7 components and require PHP 8.2 or newer. Laravel 9 and 10 applications pinned to Symfony 6 components may hit Composer resolution conflicts with version 1.3.1. Check the package's published support matrix, or stay on 1.3.0 until your application moves to Symfony 7.
- What PHP version does iserranodev/encrypt-bundle require?
- Symfony 7 implies a PHP 8.2 minimum, so expect the same floor from version 1.3.1, although the release note does not state it explicitly. If your application still runs PHP 8.1 or older, remain on 1.3.0 and plan the upgrade alongside your framework work. Ask the maintainer to document the PHP floor if the README does not list it.
- How do I configure the encryption key with environment variables?
- The package reads its key from package config or an environment variable, so keep the key out of source control and inject it per environment. Add the variable to your .env files and your deployment secret store, and never commit a production key. Rotating a key means re-encrypting existing ciphertext, so plan rotation before you ship data encrypted with the old key.
- Can encrypt-bundle encrypt serialized payloads or arrays, not just strings?
- Yes. The package advertises encryption and decryption of strings and serialized payloads, so you can protect arrays or objects after serializing them. Treat decrypted data as untrusted input: only unserialize payloads you produced yourself, and restrict allowed classes where the data could ever be tampered with. Simple values or JSON are safer than PHP objects when the ciphertext crosses a trust boundary.
- Does the package still support Symfony 6, or does 1.3.1 replace it with Symfony 7?
- Release 1.3.1 updated dependencies to work with Symfony 7, but the note does not say whether Symfony 6 support was retained or dropped. Run composer why-not iserranodev/encrypt-bundle 1.3.1 on a Symfony 6 application to see the actual constraint outcome. Until the maintainer publishes a support matrix, keep Symfony 6 applications pinned to 1.3.0.
- Which cipher and encoding does encrypt-bundle use by default?
- The package ships safe defaults for cipher selection and encoding, and both are exposed through configuration rather than hard-coded in your services. Read the package config for the exact default instead of assuming an algorithm, because the README excerpt does not enumerate it. Change the cipher or encoding only deliberately, since existing ciphertext becomes undecryptable if you switch without re-encrypting.
- How do I test encryption in a Laravel app without using real production keys?
- Bind a dedicated test key in your test environment, for example through a .env.testing file or phpunit.xml, so encrypted fixtures are reproducible. Assert the round trip (encrypt then decrypt returns the original value) and assert that tampered ciphertext throws rather than silently returning garbage. Never assert against a hard-coded ciphertext produced with a production key.
- Is iserranodev/encrypt-bundle a good alternative to Laravel's Crypt facade?
- Laravel's Crypt facade already wraps AES encryption with app-key management, so this package is most useful when you want a framework-agnostic service shared with Symfony code or non-Laravel entry points. It also keeps key configuration inside package config instead of relying solely on APP_KEY. If you only encrypt inside a Laravel application and want no extra dependencies, the built-in facade remains the lighter option.
- How actively is encrypt-bundle maintained, and will dependency updates break my app?
- The dependency surface now tracks both the Laravel and Symfony release trains, so expect periodic constraint-only patch releases. Budget a small recurring review instead of a one-off check, and record the pinned version per application so support triage knows each service's Symfony baseline. If a release note only says dependencies were updated, ask the maintainer for an explicit compatibility statement before upgrading.