- What is rector/jack and what does it actually do?
- Rector Jack is an experimental Composer tool that helps you raise PHP dependencies one version at a time instead of making risky multi-year jumps. It works purely at the composer.json manifest layer, comparing your declared constraints against Packagist metadata and rewriting version ranges. It ships three commands: breakpoint to flag outdated major packages in CI, open-versions to gradually widen constraints, and raise-to-installed to tighten constraints to what is actually installed. It contains no runtime code and no Laravel service provider, so it is framework-agnostic by construction.
- Is rector/jack still maintained and safe to depend on?
- No. The repository is archived and the package is marked deprecated with a note redirecting to a successor project. That means no patches, no security fixes, and no forward compatibility with future PHP or Composer releases. The README also carries an explicit experimental disclaimer, and the metadata is internally inconsistent, with the README claiming PHP 7.2+ while release 1.2.1 claims PHP 7.4 to 8.5. Treat it as a harvest-the-idea tool rather than a standing dependency.
- Should I install rector/jack in a Laravel application?
- You can install it with composer require rector/jack --dev, and it will run on any Composer project, including Laravel, because it has no framework coupling. However, because the package is archived and deprecated, adding it as a permanent CI dependency transfers maintenance ownership to your team without any knowledge transfer. Most teams should evaluate the redirect target first, or reimplement the small pacing workflow in-house.
- How does the jack breakpoint command fail CI, and what exit code contract does it use?
- jack breakpoint scans for outdated major packages and fails the build when the count exceeds a threshold, which is five by default. You can tune the bar with --limit, for example jack breakpoint --limit 3, and scope it to dev dependencies with --dev so low-risk upgrades are handled first. Because the check depends on live Packagist metadata, plan for rate limits, flaky networks, and air-gapped CI runners before wiring it into a pipeline, and confirm the exit code behavior against your own CI configuration.
- What is the difference between open-versions and raise-to-installed in Jack?
- open-versions gradually widens your declared version constraints so newer releases become installable, which is meant to avoid one huge risky jump. raise-to-installed tightens constraints down to the version you actually have installed, which is useful constraint hygiene. Be careful: open-versions can emit wide ranges like ^9.0|^10.0 that silently raise the transitive PHP floor, for example PHPUnit 10 requiring PHP 8.1. raise-to-installed can also over-tighten and block future patch or security releases, so run both with --dry-run and review the diff.
- Does Jack understand Laravel's version compatibility matrix?
- No. Jack has no model of Laravel internals such as framework to illuminate/* to Symfony components to PHP floor alignment. It can therefore produce a technically valid composer.json that is framework-incompatible, especially when juggling Laravel 10 or 11 against Symfony 6.4 or 7.x. Pair any constraint changes with framework-aware validation and let Composer remain the actual resolver.
- Which Laravel and PHP versions does rector/jack support?
- Jack is framework-agnostic and the README states it requires PHP 7.2+, although release 1.2.1 metadata claims PHP 7.4 to 8.5, so verify the real requirement for the version you install. It also does not know which Laravel or illuminate/* versions your application targets, so it cannot guarantee a constraint change stays inside your framework's supported range. Always run your test suite and composer why-not after any constraint rewriting.
- Does rector/jack duplicate Dependabot, Renovate, or composer audit?
- They solve different parts of the problem. Jack is a pacing policy layer that nags about stale major versions and widens constraints, while Dependabot or Renovate automates update pull requests and composer audit remains your security gate. Composer itself stays the resolver and install engine. Decide explicitly whether adding Jack is additive or duplicative for your team before putting it in CI.
- Is Jack safe to run in production, or does it add runtime overhead?
- Jack ships no service provider and no runtime code, so it has zero impact on your application at request time. It is a development and CI tool that only reads and rewrites composer.json, and its mutating commands support --dry-run. The real risk is the correctness of the resulting constraints rather than runtime behavior, so review generated diffs before merging them into a lockfile-driven workflow.
- What are the alternatives to rector/jack now that it is archived?
- First check the redirect target the deprecation points to and confirm its license, maintainer, release cadence, and whether it is drop-in with the same commands and exit codes. If the successor is unavailable or unstable, the workflow is small enough to reimplement in-house with roughly a hundred lines of Composer scripting. You can also lean on Dependabot or Renovate plus composer outdated and composer audit to capture most of the same value without adopting an unmaintained binary.