- How do I install juststeveking/laravel-webhooks?
- Use composer require juststeveking/laravel-webhooks, then publish the config and migrations if you plan to use its endpoint and delivery-attempt models. The TPM assessment describes the install as mechanically trivial but strongly cautions against adding it to composer.json outside a timeboxed spike because the package is archived. Confirm the actual webhook direction before estimating any install work. Keep the spike isolated until a decision gate closes.
- Does juststeveking/laravel-webhooks support Laravel 11 and Laravel 12?
- The last release was May 2023, so declared illuminate/* constraints likely target Laravel 9–10 with PHP 8.1/8.2. On Laravel 11 or 12 the install will probably fail or require a constraint override. The assessment flags this as the cheapest kill criterion and says to resolve it before any prototype work. Overriding constraints on an archived package is the first step toward an unplanned fork.
- Is juststeveking/laravel-webhooks still maintained?
- No. The repository is archived, has one now-inactive maintainer, and has shipped nothing since May 2023. It sits at 83 stars and zero dependents, never reached 1.0, and shows an 0.0.5 to 0.0.51 release history. There is no security patching path, no PHP or Laravel major bump, and no CVE response process.
- Does juststeveking/laravel-webhooks receive incoming webhooks or send outbound webhooks?
- The blurb says it receives and processes incoming webhooks, but the code shape described in the technical assessment—endpoint registry, delivery attempts, queued signed POSTs—looks clearly outbound. That contradiction must be resolved on day one so the team does not spend a spike on the wrong problem. Confirm which direction the package actually implements before estimating anything against it. Do not let the package description alone determine the scope.
- How do I validate webhook signatures with juststeveking/laravel-webhooks?
- The package advertises request signature validation from providers and includes HMAC signing hooks, but the assessment warns that signature format and header conventions become a customer-facing contract once external partners build against them. Verify the exact header name, signing algorithm, secret storage, and rotation support in code rather than assuming the README covers it. Secret rotation with dual-signing is one of the production concerns the assessment says must be checked, not assumed. Treat the signature format as irreversible once shipped to partners.
- Can I use juststeveking/laravel-webhooks in production?
- The technical evaluation says no—it is a sizing instrument and design reference, not a dependency to approve. It is archived, single-maintainer, has zero dependents, and has never had field validation from a production user base. A small blast radius of a few hundred lines makes fork, replace, or discard cheap, but it does not make the abandonment risk acceptable for production. Use it only inside a timeboxed investigation with a written decision gate.
- What production webhook features does juststeveking/laravel-webhooks likely lack?
- The assessment says "simple" almost certainly punts on exponential backoff with jitter, per-destination rate limiting, circuit breaking, dead-letter and replay, idempotency keys, secret rotation with dual-signing, delivery observability, and SSRF egress controls. Each of those must be verified in code, not assumed—and verifying them is the spike. Zero dependents means no production user base has surfaced edge cases like redirects, chunked responses, TLS quirks, non-2xx classification, slow endpoints, or duplicate deliveries. The lack of field validation is a real capability risk, not a documentation gap.
- How do I test juststeveking/laravel-webhooks in a Laravel app?
- A credible spike is about a day and a prototype about a week, according to the assessment. Dispatch from domain events, publish config and migrations, and verify the package's actual direction, signature handling, and queue behavior before writing integration tests. Treat any successful spike as evidence for a decision gate—adopt a maintained alternative, build in-house, or fork—not as approval to ship. Document the install constraints and any override needed on your target Laravel matrix.
- What are the alternatives to juststeveking/laravel-webhooks?
- The assessment does not name specific alternatives but sets a decision gate between adopting a maintained alternative, building in-house, or forking this package. Because the blast radius is small—a few hundred lines across a handful of classes—forking or replacing it stays cheap. The key requirements for any alternative are active maintenance, Laravel 11/12 support, and verified production features like retries, idempotency, and observability. Keep all three options open until the gate closes.
- Is juststeveking/laravel-webhooks safe to install for a quick webhook prototype?
- It can be carried as a timeboxed investigation line item, but the assessment explicitly warns against letting it land in composer.json by inertia because a spike "worked." The install is mechanically trivial, yet the package is archived and likely constrained to Laravel 9–10 and PHP 8.1/8.2. Keep the spike isolated and write a decision gate with a kill criterion before any code reaches a shared branch. Budget for the likelihood that Laravel 11 or 12 will force a fork or replacement.