- Does BotMan support Laravel 9, 10, or 11?
- Not out of the box. The latest release, botman/botman 2.6.1 (September 2020), is a compatibility patch that tops out at Laravel 7 and 8, both of which are end-of-life. Composer will refuse to resolve it on Laravel 9, 10, or 11, and forcing resolution typically surfaces PHP 8 deprecation breakage at runtime. The practical options are deploying the bot as an isolated service pinned to Laravel 8, or forking the package under its MIT license.
- How do I install BotMan in a Laravel application?
- Require botman/botman with Composer and let package auto-discovery register the BotManServiceProvider and the BotMan facade. Publish the configuration and add per-driver credentials under config/botman/, then expose a single webhook route with a CSRF exception for that route only. The effort is mostly in platform app registration and getting public HTTPS ingress working, not in the package integration itself.
- What is the difference between mpociot/botman and botman/botman?
- mpociot/botman is the abandoned pre-rename identity of the package; the project now lives at botman/botman on GitHub. If you still require mpociot/botman in composer.json you will get an old, painful dependency resolution. Use botman/botman instead, and expect the same Laravel 7/8 ceiling.
- Which messaging platforms does BotMan support?
- BotMan ships drivers for Slack, Telegram, Facebook Messenger, WeChat, a generic web driver, and several others. However, those drivers date from 2020: Telegram secret-token verification, Messenger and WhatsApp payload and auth changes, Teams, and WeChat have all moved since then, and HipChat is dead. For platform features the 2020 drivers do not model, the escape hatch is reading the raw request via $bot->getMessage()->getPayload().
- How does BotMan handle multi-turn conversations and state?
- BotMan provides a conversation engine for multi-turn dialogs with buttons and rich message types, and multi-turn state rides on Laravel's cache. That is free if you already run Redis, but a liability if you do not. Keep serialization hygiene in mind: store IDs in conversation state, never Eloquent models, closures, or resources.
- How do I secure the BotMan webhook route in Laravel?
- Verify webhook signatures in your own route middleware before BotMan ever sees the request, and fail closed when verification does not pass. Do not rely on signature handling inside the 2020-era drivers, which predate several platform auth changes. Add the CSRF exception only for the webhook route itself, and add allow-listing, rate limiting, logging, and tenant resolution as middleware around received, heard, and sending events.
- Is BotMan still actively maintained?
- No. The last release, 2.6.1, shipped in September 2020 and the package has zero recorded dependents, so you would be among the very few production users and you would find the bugs. It is MIT licensed, so forking is legitimate and often the right call. If you adopt it, name an internal owner and set a fork-or-replace trigger date up front.
- How do I test BotMan conversations in Laravel?
- BotMan is designed to be testable, with message and event handling you can drive directly from PHPUnit. Send fake incoming messages through the bot instance and assert on the replies, buttons, and rich messages produced. Treat BotMan Studio as local scaffolding and harness tooling only: the /botman/chat widget must be gated or stripped from the production route file.
- What are the alternatives to BotMan?
- Many teams either pin BotMan behind their own adapter interface so it can be swapped later, fork it under MIT, or move to LLM-native conversation tooling that a 2020-era package cannot model. Calling platform SDKs directly is also viable when you only need one or two channels. The key design rule is to put BotMan behind an adapter (for example BotMessenger::notify() and ask()) so replacing it is a class swap rather than a grep-and-refactor.
- What are the production risks of running BotMan?
- Deliveries are not deduplicated, so retried webhooks can produce duplicate replies. Exceptions can degrade into silent non-responses while health checks stay green, which is the failure mode that hurts most. Start with an internal Slack or Telegram ops bot where the blast radius is lowest and there is no customer SLA, prove a second channel before trusting the driver abstraction, and never combine a Laravel upgrade with a BotMan change.