Laravel Scavenger Laravel Package

Technical Evaluation

Assessment status: First assessment, based on v4.0.0 release notes only. No source review, changelog history, or test-coverage evidence was provided, so all findings below are derived from the stated behavior changes and should be treated as pre-vetting rather than a verdict.

Release disposition: v4.0.0 is a major, breaking release. It combines a platform floor bump, an HTTP transport swap, a changed default, and a fix that alters credential-handling semantics. It warrants a full assessment and a scoped upgrade spike before adoption.

Architecture fit

• The package sits in the long-running-process space: a daemon that authenticates against an Eloquent model to establish an ambient identity. That is a reasonable fit for Laravel shops already running Horizon, Octane, or queue workers, but it introduces a second process lifecycle outside the queue supervisor's standard model.
• Hardcoding App\Models\User as the default daemon model assumes a conventional app layout. It is a sane default for greenfield Laravel apps but a poor fit for multi-tenant or domain-oriented codebases where the authenticatable model lives elsewhere.
• The transport now uses Symfony\Component\BrowserKit\HttpBrowser directly. Goutte has been unmaintained since 2023 and was itself a thin wrapper over HttpBrowser, so this is the correct direction and removes a dead dependency. It is also the source of the primary behavioral risk.

Integration feasibility

• Moderate. The package installs cleanly, but v4.0.0 forces PHP 8.3+ and Laravel 12/13. Any application on Laravel 10/11 or PHP 8.1/8.2 must complete a framework upgrade before this package can be evaluated — the package is effectively gated behind a platform migration.
• No data migration is declared, but the password-cast change implies a credential-state migration for any environment where the old double-hashing behavior produced persisted values.

Technical risk

• High — timeout semantics. guzzle_settings.timeout now governs both the idle timeout and the total request duration. Previously it constrained idleness only. Any workflow that streams, paginates, or downloads a large payload over a slow link will begin failing at the timeout boundary even though the connection is actively progressing. This is silent until production traffic hits it.
• Medium-High — default daemon model. App\Models\User as the default means applications that relied on the previous default will resolve a different model without an explicit config change. In multi-auth or multi-guard setups this can produce authenticated-but-wrong-identity behavior rather than a clean error.
• Medium-High — password hashing semantics. Suppressing the second hash when the model uses Laravel's hashed cast is a correctness fix, but it is a behavior change on the security boundary. Two failure paths need confirmation: (a) credentials already persisted as double-hashes will now fail authentication and require re-hashing; (b) a daemon model without the cast — the package's inferred intent is that the package still hashes — must be verified, because if the fallback is removed, plaintext passwords get written to the database.
• Low-Medium — platform floor. PHP 8.3+ and Laravel 12/13 is a narrow, forward-only window. Teams on LTS-ish timelines will be excluded for a full upgrade cycle.
• Low — Symfony HttpBrowser. Actively maintained, first-party Symfony. Low supply-chain risk relative to Goutte.

Key questions for the maintainer

1. Is guzzle_settings.timeout semantics the only transport change, or do redirect, cookie-jar, and user-agent defaults also differ from Goutte? Which behaviors are now configurable to restore prior semantics (e.g. a separate connect timeout or total-duration key)?
2. What is the previous default daemon model, and is a config override documented? Is there a deprecation path or a startup warning when the default is implicitly used?
3. If a daemon model does not use the hashed cast, does the package still hash the password? What is the documented contract?
4. Is there a migration or artisan command to detect and re-hash previously double-hashed credentials?
5. Are there any changes to how the daemon resolves the model when multiple guards or connection pools are configured?

Integration Approach

Stack fit

• Target stack is Laravel 12/13 on PHP 8.3+, with a supervisor-managed daemon process alongside Horizon or the queue worker. Fits well for teams already on that baseline; blocked for everyone else.
• The dependency swap from Goutte to Symfony HttpBrowser aligns with the rest of the Symfony component graph a Laravel app already pulls in, so there is no net increase in transitive footprint — likely a decrease.

Migration path

1. Confirm the host application is already on Laravel 12 (or 13) and PHP 8.3+. If not, this package is out of scope until that migration completes; do not attempt both in one change window.
2. Audit config/ and any published package config for the daemon model setting. Pin it explicitly to the intended authenticatable class rather than relying on the new App\Models\User default.
3. Audit the daemon model for hashed cast presence and record the answer — this determines whether the package's own hashing path is active.
4. Inventory every outbound HTTP call the daemon makes and classify by expected duration: fast API calls, paginated reads, large downloads, streaming. Flag anything that can exceed a few seconds as a timeout regression candidate.
5. Reconcile credentials: identify any daemon-model records written under v3.x and verify they authenticate post-upgrade. Re-hash where double-hashing is confirmed.

Compatibility

• No backward-compatibility shim is announced. Treat v4 as a hard cutover: no mixed-version fleet, no rolling deploy across v3 and v4 workers against the same credential store.
• Downstream packages or app code that pinned Goutte transitively will see the dependency disappear; verify nothing in the app relies on Goutte types or the Goutte\Client signature.

Sequencing

• Recommended order: platform upgrade → config pinning and credential audit → timeout inventory → upgrade this package in a non-production environment → soak the daemon under realistic payload sizes → production cutover with a v3 rollback artifact retained.
• Do not bundle this upgrade with an unrelated Laravel major bump. The timeout and credential changes need an isolated blast radius to diagnose.

Operational Impact

Maintenance

• Low ongoing maintenance burden: one fewer abandoned dependency (Goutte), a first-party HTTP client, and a narrower supported platform matrix that reduces conditional code paths.
• The cost shifts left into the upgrade itself. Budget a focused spike, not a version bump.

Support

• Support surface narrows once on v4 — PHP 8.3+ and Laravel 12/13 is a small matrix, which is good for triage.
• Expect an initial wave of tickets from the default-model change, because it fails ambiguously (wrong identity) rather than loudly. Document the model pin as a mandatory post-install step in the runbook.
• The credential change will generate "daemon can't authenticate" reports. Pre-stage a diagnostic: check for double-hash prefix patterns before escalating.

Scaling

• The timeout change is the scaling-relevant item. As payload sizes and upstream latency grow, a hard total-duration ceiling converts a slow-but-succeeding workload into a retry storm. Retries multiply load against the upstream and the daemon; monitor for correlated retry bursts after the upgrade rather than isolated failures.
• Long-running daemons with an ambient user identity do not horizontally compose cleanly if the daemon mutates model state. Confirm whether the daemon's identity is read-only before scaling replica count.
• The hashed cast fix removes a per-authentication hash computation on a hot path — a small, real throughput win for daemons that re-authenticate frequently.

Failure modes

• Truncated large transfers — requests exceeding the total-duration ceiling abort mid-stream; may surface as partial writes rather than clean exceptions. Highest-severity new failure mode.
• Silent identity mismatch — daemon binds to the wrong model via the new default; authorization checks pass against an unintended principal.
• Authentication loop — double-hashed credentials fail, daemon retries, supervisor restarts, repeat. Watch for restart-count alerts.
• Plaintext credential write — only if the package's hashing fallback was removed; confirm before deployment, since this is a security incident rather than an outage.
• Mixed-version fleet — v3 and v4 workers sharing a credential store will disagree on hash format. Enforce a hard cutover.

Ramp-up

• Low for a Laravel-fluent engineer once the platform baseline is met: the mental model is a supervised long-running process with a bound identity.
• The non-obvious cost is the timeout mental model. The single most valuable onboarding artifact is a one-page note stating that guzzle_settings.timeout is now a total-duration ceiling, not an idle threshold, with the list of known long-running calls and their expected durations.
• Recommended gate before production: a soak test at realistic payload sizes, a credential round-trip test covering both cast and non-cast models, and an explicit assertion that the daemon model is pinned in config rather than inherited from the new default.