Laravel Pwned Passwords Laravel Package

Getting Started

• Confirm the compatibility gate first: 3.4.0 adds PHP 8 support, so check the package’s composer.json platform constraints and your application’s Laravel version before upgrading. Install on a branch with composer require vendor/package:^3.4 --with-all-dependencies.
• Look first at the package README, changelog, and published config. If service provider auto-discovery is enabled, no manual registration is needed; otherwise register the provider and any aliases in the appropriate application bootstrap file.
• Publish config/assets before using the package: php artisan vendor:publish --provider="Vendor\Package\PackageServiceProvider" or the package’s documented --tag. Review defaults and move environment-specific values into .env.
• First use case: integrate the package into one low-risk flow—a single command, job, or controller—and cover it with a feature test running on PHP 8. Keep the first integration small so PHP 8 compatibility issues are easy to isolate.
• If upgrading from 3.3.x, run composer update --dry-run, review the package changelog for PHP 8-specific notes, and verify the runtime with php artisan about before changing production constraints.

Implementation Patterns

• Configuration-first: publish config, keep secrets and environment values in .env, and never edit vendor files. Verify the package reads configuration through Laravel’s config repository and test with php artisan config:cache enabled.
• Prefer constructor injection over facades in application services; use facades in controllers, commands, and tests where brevity matters. If the package exposes contracts, bind them in a dedicated application service provider.
• Wrap package calls that perform I/O in queued jobs or events. This keeps request latency predictable, gives you retries, and isolates PHP 8 runtime behavior from the request cycle.
• Use the package’s extension points—custom drivers, manager extend() methods, macros, events, or container bindings—instead of subclassing internals. Register extensions in an application service provider so they are explicit, testable, and easy to remove.
• In tests, fake queues and events where appropriate and assert both success and failure paths. Add a CI matrix row for PHP 8.0/8.1 so compatibility regressions are caught before deployment.
• For gradual adoption, put the package behind a small application-level adapter. That keeps vendor APIs out of domain code and reduces the blast radius of future major upgrades.

Gotchas and Tips

• PHP 8 support in 3.4.0 does not guarantee every transitive dependency supports PHP 8. Run composer why-not vendor/package 3.4.0 and composer outdated --direct; resolve platform conflicts before merging.
• PHP 8 behavior changes can surface inside package internals: named arguments can break if parameter names change, union types can alter coercion, and deprecations around null-to-non-nullable parameters may become noisy. Run tests with E_ALL and fix deprecations rather than suppressing them.
• Config cache is a common source of “works locally, fails in CI/production.” After changing package config, run php artisan config:clear locally and php artisan config:cache in deployment.
• Auto-discovery can mask duplicate provider registration. If you see duplicate listeners or commands, check bootstrap/providers.php, config/app.php, and composer.json under extra.laravel.providers.
• Facade mocking can hide container-binding problems. Prefer $this->mock(Contract::class) or $this->instance() and verify the real binding in at least one integration test.
• If the package publishes migrations or assets, use explicit vendor:publish --tag=... calls and review diffs before production. Avoid --force in deploy scripts.
• Queue serialization and PHP 8 typed properties: if you queue package objects, confirm they serialize cleanly and do not carry unserializable resources. Test with a real queue driver, not only sync.
• Extension points worth documenting for your team: config overrides, container bindings for contracts, manager extend() methods, macros, and package events. Knowing which one your app uses makes upgrades and debugging much faster.