- How do I install johnpaulmedina/laravel-usps in a Laravel app?
- Install it with Composer using composer require johnpaulmedina/laravel-usps, then follow the package README for service provider discovery and config publishing if required. Add your USPS credentials to the published configuration or environment variables as documented. Confirm the supported Laravel and PHP versions in composer.json before installing in an existing application.
- What Laravel and PHP versions does laravel-usps v13 support?
- The evaluation identifies v13.x as a mature major line but does not provide a confirmed Laravel and PHP support matrix from the README. Check the package composer.json and release notes for the exact framework and PHP constraints. Do not assume compatibility with your runtime until you verify those constraints.
- How do I configure USPS API credentials for address validation and rates?
- The package is described as config-driven, so USPS credentials are typically supplied through a published config file and environment variables. USPS commonly requires a Consumer Key and Secret plus OAuth, but the exact credential model for this package is not confirmed in the provided record. Review the README and config file for the precise keys, and confirm whether a sandbox or test endpoint is supported.
- Does this package validate addresses with USPS DPV and ZIP/city lookup?
- Release notes referenced in the evaluation indicate address validation, city/state lookup, ZIP lookup, Delivery Point Validation, and shipping options. DPV support is a positive sign for delivery-point-level address checks. The exact method names and response shapes are not confirmed here, so check the README examples before wiring it into your domain layer.
- Can I fetch USPS shipping rates and tracking with this Laravel package?
- The package blurb says it can fetch shipping rates, track packages, validate addresses, and generate labels through USPS web tools. The technical evaluation also references shipping options and a typed ShippingOptions response surface. Keep calls behind an application-owned service or contract so vendor payloads do not leak into controllers or models.
- Is laravel-usps safe for production after the 10 security fixes in 13.4.1?
- Version 13.4.1 includes a security audit that resolved 10 issues, which is a positive responsiveness signal, but the provided record gives no severity ratings, CVE or GHSA identifiers, or affected ranges. Treat 13.4.1 or later as the minimum for production and review the advisories or commit diff before upgrading. Anyone on 13.4.0 or earlier should assess whether this is a mandatory security upgrade.
- How should I test USPS integration without hitting the live API?
- Put the package behind an application-owned interface such as an AddressValidator contract, then test your adapter with recorded USPS fixtures. Confirm whether the package or USPS account offers a sandbox or test endpoint before relying on live calls in CI. Contract tests are important because the evaluation notes that PHPStan level 5 is not a strong correctness guarantee for a thin API client.
- Does laravel-usps return XML or JSON, and is XXE a concern?
- The provided evaluation does not confirm whether responses are XML or JSON, and USPS web tools have historically used XML. XML parsing is a classic source of XXE and deserialization risk, so inspect the parser and confirm external entity handling is disabled. If the package returns XML, isolate parsing in your adapter and test malformed payloads.
- What are alternatives to johnpaulmedina/laravel-usps for USPS address validation in Laravel?
- Alternatives include calling USPS Web Tools or newer USPS APIs directly through Laravel's HTTP client, using a different USPS SDK, or adopting a dedicated address-validation service. Compare maintenance activity, security disclosure practices, Laravel version support, and testability before switching. For a peripheral integration, a thin application-owned wrapper often gives you more control than a heavier package.
- Is the package actively maintained and what are the upgrade concerns from v12 to v13?
- The evaluation shows active release engineering, conventional commits, automated changelog, GitHub Actions, and PHPStan, which suggests ongoing maintenance. The v12 to v13 major bump may include breaking changes, so review the changelog and upgrade guide before moving production code. Also check whether 13.4.1 changed public signatures, config keys, or exception types.