Two Factor For Laravel Laravel Package

Technical Evaluation

This release is a static-analysis tooling fix, not a runtime change. The package is a Laravel two-factor authentication add-on that registers schema macros (twoFactorColumns(), dropTwoFactorColumns()) on the blueprint. Because macros only exist once the service provider boots, static analysers that don't boot the provider (Testbench package development, dont-discover apps, manually registered providers) reported "Call to an undefined method" on migrations using those macros. Version 1.1.6 ships a PHPStan extension declaring the macros, auto-loaded via phpstan/extension-installer through extra.phpstan.includes.

Architecture fit: unchanged. Nothing about the runtime contract, migrations, models, or middleware shifts. The fix is additive — a extension.neon file plus composer metadata. Integration risk is low and one-directional: it can only remove false positives, and only for teams running Larastan/PHPStan.

Technical risk is confined to the analysis layer. Two things to verify: that extra.phpstan.includes doesn't conflict with a host app's existing PHPStan configuration, and that extension-installer being absent is handled (the README documents a manual include, so it is, but it's a documentation dependency rather than an automatic one).

Key questions: Does the extension activate for apps that never run static analysis (it shouldn't, and it shouldn't add weight if it doesn't)? Is the extension version-pinned against the package version, so a PHPStan major bump doesn't silently break CI? And does the macro signature declared in the extension match the runtime signature, or could they drift?

Integration Approach

Stack fit: Laravel 9/10/11 applications using the package on PHP 8.1+. The change matters only to teams with PHPStan or Larastan in CI — a common but not universal setup. Teams without static analysis see no behavioural difference at all.

Migration path: drop-in on composer update. No database migration, no config publish, no breaking API change. The version bump is patch-level and correctly so.

Compatibility caveat: phpstan/extension-installer must be present for automatic pickup. Where it isn't — and some teams deliberately exclude it because it auto-loads third-party config — the manual includes entry is required. That's a real, if small, piece of integration friction and should be in the upgrade notes rather than inferred from the release body.

Sequencing: no ordering constraints against other packages. Recommended sequence for teams currently suppressing the false positive: update the package, remove any inline @phpstan-ignore or stub entries for these macros, then run the analyser and confirm the errors do not return. Removing the suppressions is the step that actually captures the value; leaving them in place means the fix is inert.

Operational Impact

Maintenance: net reduction in toil. The false positive previously had to be worked around per-project, either with baseline entries or ignore comments, and those accumulate. This centralises the fix in the package where it belongs.

Support: the failure mode it addresses is a confusing one — the migration is correct and runs fine, but CI fails. That generates support load disproportionate to the underlying issue. Expect a small uptick in questions of the form "do I still need my stub file?" after release.

Scaling: no runtime cost, no query or boot-path change. Irrelevant to production performance.

Failure modes: (1) extension present but extension-installer absent and manual include not added — false positive persists, no regression; (2) extension and a host baseline both defining the macro — benign duplication at worst, but worth confirming PHPStan doesn't warn; (3) PHPStan major version upgrade diverging from the extension's supported range — could fail analysis outright, which is louder than the original problem but recoverable by pinning.

Ramp-up: effectively zero for existing users. The one-line addition is not a workflow change and requires no training or documentation beyond the upgrade note.