Parameter Encryption Phpseclib Bundle Laravel Package

Getting Started

• Install with composer require <vendor>/<package> and confirm the Symfony constraint resolves for your app: composer show <vendor>/<package> should now show symfony/* at 4.x if you're on Laravel 5.6+ (Laravel 5.6/5.7 ship Symfony 4 components; 5.4/5.5 stay on 3.x). If Composer still picks the old release, run composer why-not <vendor>/<package> 1.1.0 to see the blocking constraint.
• First place to look is the package's service provider and its config file: php artisan vendor:publish --provider="Vendor\Package\PackageServiceProvider" then read the published config/<package>.php top to bottom. The defaults are the documented happy path; most day-to-day tuning happens here rather than in code.
• If the package is auto-discovered (Laravel 5.5+), you should not need to touch config/app.php. If the provider isn't in bootstrap/cache/packages.php, run php artisan package:discover before debugging anything else.
• First use case to validate the upgrade: exercise the one code path that touches Symfony classes — typically the request/response or console-kernel bridge — by hitting a route that returns the package's response object and running the related artisan command. If both work on Symfony 4, the rest of the integration is almost certainly fine.

Implementation Patterns

• Version-gated integration. Guard anything that depends on Symfony-only APIs behind a version check rather than a Laravel version check, e.g. version_compare(\Symfony\Component\HttpKernel\Kernel::VERSION, '4.0.0', '>='). This keeps the package usable on both Laravel 5.5 and 5.7 installs without forking.
• Service container binding. Register the package's manager/client as a singleton in a small app-level service provider and inject it, rather than resolving it from the container inline. The Symfony 4 upgrade mostly changed constructor signatures; a single binding point means one place to fix if signatures shift again.
• Config-driven behavior. Prefer publishing and editing config over subclassing package classes. Environment-specific values belong in .env and should be read via config() inside your own provider, not inside vendor code.
• Middleware wrapping. When the package manipulates the request/response cycle, wrap it in your own middleware so you control ordering relative to StartSession, SubstituteBindings, and ShareErrorsFromSession — ordering bugs are the most common integration failure here.
• Testing pattern. Bind a fake/mock of the package's client in setUp() via $this->app->instance(...). Because the package now runs on Symfony 4, use Illuminate\Foundation\Testing\TestCase helpers ($this->get(), $this->artisan()) rather than instantiating Symfony Request/Response objects directly — the Symfony 4 constructors are stricter about argument types.
• Upgrade workflow. Bump the package on a branch, run the full test suite, then smoke-test in a staging environment with the same PHP minor version as production (Symfony 4 requires PHP 7.1.3+). Keep the previous version pinned in composer.lock on main until staging is green.

Gotchas and Tips

• Composer constraint conflicts after upgrading. Widening Symfony support to 4.x can collide with packages still pinned to ^2.7|^3.0. Run composer update "<vendor>/<package>" -W (with --with-all-dependencies) so transitive Symfony packages move together; otherwise you get a partial upgrade and confusing "class not found" errors at runtime.
• PHP version floor. Symfony 4 components require PHP 7.1.3+, so CI matrices pinned to 7.0 will fail on install rather than on test. Check .travis.yml/GitHub Actions matrix before blaming the package.
• Removed dist configs are not a runtime concern. phpunit.xml.dist and .php_cs.dist are now excluded from git exports, so they won't appear in vendor/. This only matters if you fork the package or run its test suite locally — use composer require --prefer-source to get the full repository, and don't depend on those files existing in vendor/.
• Don't edit vendor/. With the dist configs gone there's even less reason to be inside the package directory. If you need behavior changes, extend the class or rebind in a service provider.
• Cache clearing is not optional. After any upgrade, run php artisan config:clear && php artisan cache:clear && composer dump-autoload. Stale bootstrap/cache/config.php masking new config keys is the single most common "the upgrade broke it" false alarm.
• Debugging extension points. The package's manager class is usually bound as a singleton — resolve it with app(Manager::class) in tinker and inspect it before adding logging. If you need to trace calls, decorate the binding in a service provider rather than patching vendor code, so future upgrades stay clean.
• Symfony 4 deprecations. Expect deprecation notices from Symfony internals under Laravel's error handler; they are not package bugs. Silence them selectively with error_reporting(E_ALL & ~E_DEPRECATED) in a local-only provider rather than globally.