- How do I install lab123/lumen-notification in Lumen 10 or 11?
- Require the package with Composer, then register its service provider in bootstrap/app.php. Because Lumen's vendor:publish support is limited, you typically copy the package config into your application's config directory manually. Plan roughly half a day to a day to get a first working mail channel, including mailer and queue configuration.
- Does lab123/lumen-notification work with Laravel 10, 11, 12, and 13?
- The package claims support for Lumen 10/11 and Laravel 10-13. That Laravel range is deliberate according to the release notes, but the main value is for Lumen, since full Laravel already includes the native notification layer. Treat Laravel support as a secondary use case rather than the primary reason to adopt it.
- Which notification channels does lab123/lumen-notification support?
- The package description advertises mail, database, and other channels, but the provided release notes do not include a detailed tested channel matrix. Database and broadcast support, associated migrations, and test coverage are specifically flagged as unknown in the technical assessment. Confirm the exact channels you need, such as mail, database, broadcast, Vonage, or Slack, with the maintainer before relying on them.
- How do I configure mail and services for notifications in Lumen?
- You configure the package by placing its mail and services settings into your application's config directory, since Lumen does not provide the same vendor:publish workflow as Laravel. You also need to set up your mailer and queue driver so queued notifications can be dispatched reliably. The service provider must be registered in bootstrap/app.php before these settings take effect.
- How do I register the artisan commands included with this package?
- The package adds notification artisan commands, and in Lumen you register commands through the console kernel rather than relying on Laravel's automatic command discovery. Follow the package setup steps after adding the service provider in bootstrap/app.php. If a command does not appear, check the console kernel registration and clear any cached bootstrap files.
- Do I need to add a composer audit ignore for PKSA-zwc5-qtrz-zm1n?
- Yes, the 1.0.0 release adds a required composer audit ignore for advisory PKSA-zwc5-qtrz-zm1n on Lumen/Laravel 10 and 11. This is a governance decision, not just a config line: assign a named approver, document the rationale, and set a review date. Scope the ignore to the exact advisory ID, affected package, and branch rather than using a wildcard.
- Is it safe to suppress the PKSA-zwc5-qtrz-zm1n advisory?
- The assessment describes PKSA-zwc5-qtrz-zm1n as a known unpatched vulnerability with no upstream fix, and the package instructs consumers to suppress it. Severity, CVSS, attack vector, and whether the vulnerable code path is reachable through the notification layer are not established in the provided release notes. That reachability question should be answered before adoption; suppressing the warning turns it into an accepted, persistent risk.
- Does lab123/lumen-notification support database notifications and migrations?
- Database notifications are mentioned in the package description, but the provided release notes and technical assessment do not document Lumen-loadable migrations or database channel testing. The assessment explicitly flags database and broadcast channels, migrations, and test coverage as open questions. Verify the migration setup and test the database channel in a spike before committing to it.
- Can I upgrade from 0.1.0-beta.2 to 1.0.0 on Lumen 8 or 9?
- No supported upgrade path is described. Version 1.0.0 raises the PHP floor to ^8.1 and targets Lumen 10/11, leaving Lumen 5-9 users stranded on 0.1.0-beta.2 with no backported fixes. New adopters face a cheap break, but anyone already running the beta must upgrade Lumen or fork the package.
- Is lab123/lumen-notification production-ready and well maintained?
- The assessment notes a bus factor of one, two stars, zero dependents, no commercial backing, and no production evidence. The maintainer appears engaged because the advisory handling is documented, but there is no security team behind the disclosure and CI coverage against real Lumen 10/11 and PHP 8.1-8.3 is not stated. Treat adoption as a spike with explicit risk acceptance, and consider full Laravel's native notifications if you need a better-supported path.