- What is mpociot/captainhook for in Laravel?
- The supplied context is contradictory: the repository assessment describes a 2016 Git hook manager, while the overview and blurb describe Laravel webhook handling and outbound model-event webhooks. Before installing, open composer.json, src/, and the README in the actual repository to confirm which package you are evaluating. Treat it as a pattern or prototype, not an architectural commitment.
- Is CaptainHook a Git hook manager or a Laravel webhook package?
- Both descriptions appear in the supplied material, which is why the first step is verification. The repository assessment identifies a versioned PHP config that installs into .git/hooks for pre-commit, commit-msg, and pre-push commands. The overview describes inbound webhook handlers for providers like GitHub, Stripe, and Shopify, while the blurb describes outbound Eloquent model-event webhooks. These are different products with different risk profiles.
- Does CaptainHook support Laravel 8, 9, 10, or PHP 8?
- The technical assessment warns of likely version drift: last release December 2016, illuminate/* constraints, Guzzle and HTTP client drift, and event-dispatcher or container incompatibilities on Laravel 8+ and PHP 8. Do not assume modern Laravel support; test Composer resolution first and avoid --ignore-platform-reqs as a shortcut. Budget for a rewrite or fork rather than an upgrade.
- How do I install CaptainHook with Composer?
- The Git-hooks reading suggests composer require, publishing config, installing generated scripts, and verifying with cat .git/hooks/pre-commit. The webhook reading suggests publishing config and migrations and attaching a trait to a model. However, the package was last released in 2016 with zero Packagist dependents, so Composer may not resolve on current Laravel. Confirm the actual Artisan verb in source because the 2016 documentation is inconsistent.
- Can CaptainHook verify webhook signatures from Stripe or GitHub?
- The overview claims built-in signature verification for supported providers, but the repository assessment says the actual code is likely a Git hook manager. If you are evaluating the webhook variant, do not rely on claimed provider support without auditing src/ for signature logic. The assessment also notes unsigned payloads in the outbound-webhook reading, which would mean spoofing risk.
- Does CaptainHook process webhooks in a queue?
- The overview says handlers integrate with Laravel's queue and that processing is queueable through jobs. In practice, use a real queue driver such as database or redis, never sync, for any heavy webhook work. The assessment warns that delivery guarantees such as retries with backoff, dead-lettering, idempotency keys, and auto-disable on repeated failure are absent in the webhook reading.
- Is CaptainHook safe for production webhooks?
- Treat it as beta-grade or inherited code, not SLA-grade infrastructure. The technical assessment flags no retries with backoff, no dead-lettering, no idempotency key, no rate limiting, and no payload signing for outbound webhooks. If customer-supplied URLs are involved, SSRF is a concern, so block link-local and private ranges. Secrets in committed config are also a risk unless loaded from environment variables.
- What are alternatives to CaptainHook for Laravel webhooks?
- If you need inbound third-party webhooks, the assessment says this package is irrelevant to that problem; look at maintained Laravel webhook packages or build a small controller plus signature middleware. If you need outbound model-event webhooks, the pattern is Eloquent events to a queued job to a signed HTTP POST, and a maintained package or in-house implementation is usually safer. The key decision is whether delivery is best-effort or contractual with audit and replay.
- How should I test CaptainHook before committing?
- For Git hooks, trial it on one team and verify the generated .git/hooks scripts and command construction. For webhooks, publish config and migrations, attach the trait to a model, register a URL, deliver through a real queue driver, and observe against a request bin. Also test failure paths: retries, dead-lettering, idempotency, and signature verification if applicable.
- Is mpociot/captainhook maintained?
- The assessment says the last release was December 2016, with zero Packagist dependents, no upstream triage, and no security patching. It recommends treating the code as roughly 200 lines of inherited code rather than a dependency. Check the actual repository and Packagist before adoption, and expect to fork or rewrite for modern Laravel.