Product Decisions This Supports

Security and supply-chain roadmap: 1.1.0 makes this package more viable as a lightweight integrity control for Laravel/PHP applications using Composer vendor directories. The new hash-update command reduces the operational friction that normally blocks adoption of hash-verification tooling.
Build vs buy: The package now covers two PM-relevant needs out of the box: configurable behavior and a supported way to refresh expected vendor hashes after approved dependency changes. This weakens the case for a custom Artisan command or ad hoc CI script.
Release and deployment governance: Product and platform teams can use the hash-update command as an explicit step after approved Composer changes, then verify integrity in CI or deployment gates. This supports decisions about gating releases on vendor-directory consistency.
Operational rollout: Basic config support enables per-application or per-environment tuning, which makes piloting on one service and expanding later more practical.
Use cases: dependency-change runbooks, deployment integrity checks, incident response for unexpected vendor changes, and low-cost guardrails for teams that want Laravel-native tooling rather than a larger security platform.

When to Consider This Package

Consider it when the application is Laravel/PHP, depends on Composer’s vendor directory, and needs a simple way to detect unexpected vendor changes or keep expected hashes current after approved dependency updates.
Consider it when the team wants an Artisan-native workflow and basic configuration rather than a heavyweight policy engine or custom internal tooling.
Consider it for a pilot when the package can be inserted into existing CI/deployment steps without changing the application architecture.
Look elsewhere when the organization needs full SBOM generation, software composition analysis, signed artifacts, centralized policy enforcement, transitive dependency intelligence, or non-PHP/non-Composer coverage.
Look elsewhere if the team cannot define who may run the hash-update command after dependency changes, or if the package would create a false sense of security without broader artifact and dependency controls.

For executives: 1.1.0 is a low-risk, additive release that improves the package’s operational fit. It adds basic configuration and a command to refresh vendor hashes, reducing manual toil and making vendor-integrity checks easier to adopt as a lightweight control in Laravel deployments.
For engineering: Treat the new hash-update command as part of the approved dependency-change workflow, not an ad hoc developer action. Document when it runs, restrict who can run it, wire verification into CI/deploy where appropriate, and use the new config support to pilot on one service before broadening adoption.
Recommendation: Run a time-boxed pilot on one Laravel service with Composer vendor dependencies. Measure setup effort, false-positive rate, and whether the hash-update step fits the existing dependency-update runbook before making it a standard.