Laravel Gravatar Laravel Package

Product Decisions This Supports

• Profile and identity surfaces ship faster. Avatars appear in nav bars, comment threads, activity feeds, team rosters, and admin tables. <x-gravatar /> owns the <img> markup, so retina srcset and an outage fallback arrive without design or eng debate — which pre-empts the two predictable post-launch tickets: "avatars are blurry on my MacBook" and "every avatar is a broken image during a Gravatar incident."
• Build vs buy, priced honestly. A developer can hand-roll a Gravatar URL in an afternoon. The real scope is the second 80%: 2x srcset capped at Gravatar's 2048px ceiling, an onerror local fallback that is distinct from Gravatar's own default: image, SHA256 instead of reversible MD5, parameter validation that throws at render instead of emitting dead URLs, cached has()/profile() calls (negative results included, so missing profiles don't re-request per page load), and a fake() so CI stops depending on a third-party HTTP service. That — not the URL string — is the estimate to compare against.
• A cheap roadmap experiment in profile enrichment. Gravatar::profile() returns display name, location, job title, company, pronouns, and verified accounts with no API key. That's a one-sprint, killable bet for pre-filling onboarding forms, suggesting a headline in a profile editor, or adding trust signals to a marketplace listing. If it doesn't move activation, we delete a config line.
• QR codes as a feature primitive, not a gimmick. Public profile links for print, event badges, and offline handoffs. type: 'user' (avatar in the centre) is the version worth demoing to design; version: 3 is the modern-dots style.
• Test-suite reliability as a purchasing criterion. Gravatar::fake() with assertLookedUp/assertNothingLookedUp converts an external HTTP dependency into deterministic fixtures. Small win, but a defensible one on engineering-time grounds alone.
• One less security-review conversation. Defaulting to SHA256 (per Gravatar's own spec, because MD5 is reversible and can leak the address it was built from) means we're not defending an MD5 hash of user emails in a review. MD5 stays opt-in for legacy URLs.

When to Consider This Package

Adoption gate — all of these must hold:

• We are on, or committed to, PHP 8.5 + Laravel 13. The README's requirements line is a hard floor, not an aspiration. On Laravel 10/11/12 this is a non-starter today, regardless of how good the ergonomics look.
• Avatars are garnish, not differentiator. If identity is core (social graph, verification, moderation, avatar upload), we should own that pipeline end to end.
• We accept a single-maintainer, 1-star, zero-dependent dependency. Mitigations are non-negotiable: pin the exact version in composer.json, keep every call site behind our own AvatarService or a single Blade partial, and don't let the HasGravatar trait leak into domain models other teams consume.
• We're comfortable with a free Automattic service and no SLA. The fallback prop fixes the visual failure, not the dependency itself.

Look elsewhere when:

• The stack doesn't match. Most teams, right now. Use creativeorange/gravatar (the established Laravel option) or a ~40-line internal helper.
• We need generated avatars rather than Gravatar-hosted ones. DiceBear, Boring Avatars, or UI Avatars — Gravatar only helps users who registered one; the default: parameter is the seam where those plug in.
• We need upload, cropping, moderation, or storage. This package builds URLs and reads public profiles. Full stop.
• Procurement requires community validation or an audit trail. 1 star, 0 dependents, no external review means we'd be the first real adopter and would be doing the diligence ourselves.
• We need the full profile payload reliably. Anonymous callers get a truncated profile (no timezone, languages, contacts, links, interests, gallery; verified accounts capped at four). That requires registering for a free API key — a small but real ops step, and a support surface when the key expires or rate-limits.

How to Pitch It (Stakeholders)

Executives: "A small MIT-licensed utility that removes a recurring class of polish bugs — blurry avatars on high-density screens, broken-image icons whenever a third party has an outage — and gives us a zero-cost option to pull public profile data (name, title, company) into onboarding. Cost is one composer line and no vendor contract. The risk is that it's a one-person open-source project targeting the newest PHP/Laravel versions, so we pin the version, wrap it behind one internal interface, and can replace it in an afternoon if it's abandoned. Recommendation: adopt as a convenience dependency, not platform infrastructure, and revisit if avatars become a product differentiator."

Engineering: "Thin, tested wrapper over Gravatar URLs that handles what we'd otherwise forget: SHA256 by default, 2x srcset auto-skipped past the 2048px ceiling, an onerror local fallback distinct from Gravatar's default: image, strict parameter validation that throws instead of emitting dead URLs, cached has()/profile() with negative caching, and Gravatar::fake() so tests never touch the network. Four entry points — Blade directive (URL only, goes in your own src), component (owns the <img>, adds srcset + fallback, forwards attributes), facade, and a fluent builder that stringifies straight into Blade. Only two methods hit the wire, both cached and both TTL-configurable. Caveats: requires PHP 8.5 / Laravel 13, single maintainer, no downstream users — so pin it, and keep every call site behind our own AvatarService so the exit cost stays near zero."