Laravel2Step Laravel Package

Product Decisions This Supports

• Build vs. buy for email-based two-step verification: v6.0.0 makes jeremykenedy/laravel2step viable again for fresh Laravel 11–13 applications, so it is now a realistic “buy” candidate for teams that need a lightweight second verification step without building flow, middleware, notifications, views, and config themselves.
• Upgrade roadmap for existing adopters: this is a major version and will not be picked up automatically. Teams on ^5.0 must explicitly require ^6.0, test behaviour changes, and decide whether to upgrade, pin, or stay on v5.0.0.
• Security posture: the middleware fix means protected controller actions no longer execute before verification. That is a meaningful security bug fix and should influence risk acceptance for apps currently relying on v5 behaviour.
• Platform modernization: Laravel 12/13 support is now backed by CI on PHP 8.2–8.5, with weekly runs, lowest-dependency coverage, Pint, and composer audit. This improves confidence for current-platform adoption.
• Operational configuration decisions: teams must review CSP allowlists for the new Bootstrap CDN default, confirm database connection defaults, and check whether they extend TwoStepController or depend on inherited controller methods.
• Use-case fit: best suited to admin panels, internal tools, MVPs, and Laravel apps that want an email-based verification step with published config/views. It is not a replacement for a full identity platform or advanced MFA.

When to Consider This Package

Consider it when:

• You are building or maintaining a Laravel application that needs a simple email-based two-step verification challenge.
• You are on Laravel 12 or 13 and want a package that now has a real test suite and GitHub Actions CI.
• You want configurable views, email notifications, middleware, and database-backed verification state without building the flow from scratch.
• You can tolerate a small, community-maintained package and are prepared to test upgrades yourself.
• You are on Laravel 11 and willing to validate the upgrade manually, since CI covers Laravel 12/13 rather than 11.

Look elsewhere or stay put when:

• You need TOTP, WebAuthn, SMS, recovery codes, device trust, or enterprise-grade MFA.
• You require a vendor with a formal security programme, long-term support commitments, or guaranteed compatibility across older Laravel versions.
• You are on Laravel 11 or below and cannot test the package yourself; the release notes explicitly suggest staying on v5.0.0 if needed.
• You depend on the old middleware side effect where guarded controller actions ran before verification.
• You extended TwoStepController and rely on inherited authorize() / validate() methods from your application base controller.
• You cannot accommodate the configuration changes around CDN/CSP or database connection defaults.

How to Pitch It (Stakeholders)

For executives: v6.0.0 revives a lightweight two-step verification package for current Laravel versions. It fixes serious issues—most notably protected routes executing before verification—and adds an 81-test Pest suite plus GitHub Actions CI. It can reduce time-to-market for email-based verification in admin panels and internal tools, but it is a major upgrade with behaviour changes and remains a small community dependency. Approve adoption only with a tested upgrade path and a clear decision not to rely on it for advanced MFA.

For engineering: treat this as a controlled major upgrade. Require ^6.0 explicitly, review the middleware ordering change, confirm no code depended on protected actions running for unverified users, check CSP for the new Bootstrap CDN default, verify database connection configuration, and test any controller extension. CI covers Laravel 12/13 on PHP 8.2–8.5, not older framework versions, so Laravel 11 and below need manual validation or should stay on v5.0.0.