Weave Code
Slack Bundle Laravel Package
slowhop/slack-bundle
A Symfony bundle that simplifies Slack integration, providing configuration and services for webhooks, notifications, and Slack API connectivity so your PHP app can send messages with minimal setup.
This bundle provides integration with the Slack API library, allowing you to interact with the Slack API from within your Symfony projects
Frequently asked questions about Slack Bundle
- Can I install slowhop/slack-bundle in a Laravel application?
- Not cleanly. slowhop/slack-bundle is packaged as a Symfony bundle (CL\SlackBundle), so it expects a Symfony kernel, a registered Bundle class, a DependencyInjection extension, and Symfony's event dispatcher rather than Laravel's service container and package auto-discovery. Laravel will not auto-register the bundle, and Composer is likely to refuse resolution because of old Symfony and PHP constraints. The only workable option is to strip the bundle wrapper and call the underlying service classes from a Laravel service provider, which effectively makes you the maintainer.
- Does slowhop/slack-bundle support Laravel 10 or 11?
- No. The package predates modern Laravel and is built for Symfony 2.x/3.x-era conventions, with PHP constraints that likely exclude PHP 8.1 and above. Laravel 10 and 11 require PHP 8.1+, so Composer will almost certainly block installation without --ignore-platform-reqs or a fork. Neither workaround is recommended for a production application.
- What Laravel package should I use instead for sending Slack notifications?
- For outbound notifications, which is the most common use case, use laravel/slack-notification-channel. It is first-party, maintained, queue-aware, and supports Block Kit. For broader Web API calls, slack-php/slack-php-api or a thin Saloon connector is a better fit. For inbound webhooks and slash commands, a small in-house controller with signing-secret verification middleware is usually enough.
- Does slowhop/slack-bundle support Block Kit and modern Slack APIs?
- The README claims attachments and blocks, but a bundle of this vintage is unlikely to genuinely implement Block Kit. It predates Slack's OAuth v2, granular scopes, and request signing, and it may still target deprecated legacy tokens or RTM endpoints. Verify the actual API calls and payload structure before trusting the documentation. Do not assume modern Slack features work without reading the source.
- Is slowhop/slack-bundle maintained and safe to use in production?
- There is little to no public signal of maintenance: zero stars and zero dependents mean no production validation and no issue history to learn from. An unmaintained package handling Slack inbound requests is a security concern, especially if it lacks HMAC-SHA256 signature verification with a replay window. For any internet-facing endpoint, that is a blocking finding. Treat it as unsupported code you would own entirely.
- How should I verify Slack signing secrets in a Laravel app?
- Slack sends an X-Slack-Signature header and timestamp, and you must compute an HMAC-SHA256 over the version, timestamp, and raw request body using your signing secret. Compare the result with hash_equals and reject timestamps older than five minutes to block replays. Implement this as middleware in Laravel rather than inheriting it from an old bundle. This is the one piece you should never take on trust from unmaintained code.
- How do I handle Slack webhooks and slash commands in Laravel?
- Create a small controller route, verify the Slack signature middleware first, then dispatch a queued job for any slow work so you respond within Slack's three-second window. Slash commands and interactive payloads arrive as form-encoded or JSON POSTs, so read the raw body before any middleware mutates it. This approach is simpler and safer than bridging a Symfony bundle into Laravel.
- What PHP and Symfony versions does slowhop/slack-bundle require?
- The bundle-era packaging and CL vendor prefix point to a Symfony 2.x origin from roughly 2014 to 2016, likely pinning Symfony ^2.x or ^3.x and PHP 5.5 or 7.0. Check composer.json for exact constraints before planning anything, because modern Laravel needs PHP 8.1 or newer. If resolution fails, do not paper over it with --ignore-platform-reqs; choose a maintained alternative instead.
- How do I test a Slack integration in a Laravel application?
- Use Laravel's HTTP fake or Notification fake to assert outgoing payloads without hitting Slack, and unit-test your signature middleware against known-good and tampered payloads. If you did vendor an old bundle, you would also need to test it yourself, since there is no evidence of a maintained test suite or CI. Testing your own thin integration is far cheaper than validating an inherited one.
- Can I bridge a Symfony bundle into Laravel with a service provider?
- Technically you can hand-bootstrap Symfony components and the bundle inside a Laravel service provider, but it creates a permanent translation layer every engineer must learn. You would be vendoring a small, unmaintained HTTP wrapper and owning it forever, with no benefit over Guzzle, Saloon, or a maintained Slack library. For a mixed Symfony and PHP estate, Symfony Notifier's Slack bridge is the appropriate choice on the Symfony side.
Weaver
How can I help you explore Laravel packages today?