- Is pierre-vassoilles/recaptcha-bundle compatible with Laravel?
- No Laravel-specific integration is indicated. The package is described as a Symfony bundle that provides a Symfony form element and Twig helpers for Google reCAPTCHA v2, so it does not ship a Laravel service provider, validation rule, or Blade directive. Laravel teams would need to wrap the underlying verification logic in their own rule or middleware, and should confirm that the bundle's Symfony dependencies install cleanly in a Laravel project before committing.
- How do I install and configure the package?
- Installation follows Symfony conventions: require the package with Composer, enable the bundle in your Symfony kernel or bundles.php, and configure your Google reCAPTCHA site and secret keys through the bundle's configuration. The assessment flags that config may not be publishable and auto-discovery may be absent, so verify the actual service registration steps in the repository. Laravel users should expect manual wiring rather than a publishable config file and package discovery.
- Does it support reCAPTCHA v3 and score thresholds?
- The package description only promises a form element for Google NoCaptcha reCAPTCHA v2. There is no stated support for v3 score thresholds, action-name matching, or hostname validation. If your risk model depends on score-based decisions, inspect the source or assume you will need to add that logic yourself.
- Which Laravel and PHP versions are supported?
- The assessment found no published Laravel or PHP version support matrix and no CI evidence. Because the package is a Symfony bundle, Laravel version compatibility is not guaranteed and should be treated as unverified. Check composer.json constraints and run the install against your target PHP and framework versions before adoption.
- How are Google reCAPTCHA error codes surfaced?
- The available materials do not document how error codes such as invalid-input-secret, timeout-or-duplicate, or bad-request are exposed to the caller. They may surface as a validation failure, an exception, or a silent false, and that distinction matters for logging and user messaging. Review the verification service and add explicit handling if the package collapses errors into a generic boolean.
- Can I test reCAPTCHA verification in CI with Http::fake or mocks?
- No Laravel Http::fake()-based testing support is described, and the package appears to use Symfony's HTTP client conventions. For CI you will likely need to mock the verification service or use Google's documented test keys rather than relying on a built-in fake. Confirm request timeout behavior so tests do not hang on outbound calls.
- Is the package safe to use in production and under Laravel Octane?
- The package is at version 0.9.0, which SemVer treats as pre-1.0 and unstable despite any stable label. There is no evidence of a test suite, CI, or Octane-specific review, and verification is a synchronous outbound call on the request path. Treat it as greenfield adoption, pin the version, and keep a fork or replacement plan.
- How do I add reCAPTCHA to a Laravel form without a native package?
- You would render the reCAPTCHA widget yourself, collect the token in the request, and call the package's verification service from a custom validation rule or middleware. Keep the call at the HTTP boundary so domain logic stays unaware of the vendor. Because the package is Symfony-oriented, a small adapter class makes it easier to swap to hCaptcha or Turnstile later.
- What are the alternatives to this package for Laravel?
- Laravel-native reCAPTCHA packages, hCaptcha, and Cloudflare Turnstile are common alternatives with different privacy and UX tradeoffs. Turnstile and hCaptcha are often considered when EU data-protection concerns make sending signals to Google a legal review item. Whichever you choose, abstract verification behind an internal interface so the vendor is replaceable.
- Is the package actively maintained and what is the bus factor?
- The assessment notes a single-package author, Symfony bundle naming, and no observable maintainer breadth, which suggests a high bus factor risk. Version 0.9.0 with no prior published assessment means there is no track record for security disclosures or release cadence. Mitigate by vendoring a fork or wrapping the integration so you can maintain it internally if needed.